From 5860d67fe61ec109c961e1504b90ed6ac3151a39 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Feb 2022 23:00:57 +0000
Subject: [PATCH 01/42] Bump charset-normalizer from 2.0.9 to 2.0.11

Bumps [charset-normalizer](https://github.com/ousret/charset_normalizer) from 2.0.9 to 2.0.11.
- [Release notes](https://github.com/ousret/charset_normalizer/releases)
- [Changelog](https://github.com/Ousret/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ousret/charset_normalizer/compare/2.0.9...2.0.11)

---
updated-dependencies:
- dependency-name: charset-normalizer
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index f3399259b4..3ab5c7dcca 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,7 +8,7 @@ CacheControl==0.12.10
 certifi==2021.10.8
 cfgv==3.3.1
 chardet==4.0.0
-charset-normalizer==2.0.9
+charset-normalizer==2.0.11
 colorama==0.4.4
 coloredlogs==15.0.1
 configparser==5.2.0

From c117b2c130012e2ca4151b7bfcc21f24fdcad087 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Feb 2022 23:01:00 +0000
Subject: [PATCH 02/42] Bump tomli from 1.2.2 to 2.0.0

Bumps [tomli](https://github.com/hukkin/tomli) from 1.2.2 to 2.0.0.
- [Release notes](https://github.com/hukkin/tomli/releases)
- [Changelog](https://github.com/hukkin/tomli/blob/master/CHANGELOG.md)
- [Commits](https://github.com/hukkin/tomli/compare/1.2.2...2.0.0)

---
updated-dependencies:
- dependency-name: tomli
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index f3399259b4..6e59cb71b2 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -66,7 +66,7 @@ stix2-patterns==1.3.2
 taxii2-client==2.3.0
 termcolor==1.1.0
 toml==0.10.2
-tomli==1.2.2
+tomli==2.0.0
 typing==3.7.4.3
 tzlocal==4.1
 urllib3==1.26.6

From aa6d2ad28a586a46fffef4641eb9d3c3711127ce Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Feb 2022 23:01:11 +0000
Subject: [PATCH 03/42] Bump pre-commit from 2.16.0 to 2.17.0

Bumps [pre-commit](https://github.com/pre-commit/pre-commit) from 2.16.0 to 2.17.0.
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/master/CHANGELOG.md)
- [Commits](https://github.com/pre-commit/pre-commit/compare/v2.16.0...v2.17.0)

---
updated-dependencies:
- dependency-name: pre-commit
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index f3399259b4..bbabc2be49 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -38,7 +38,7 @@ pendulum==2.1.2
 pep517==0.12.0
 Pillow==9.0.0
 platformdirs==2.4.1
-pre-commit==2.16.0
+pre-commit==2.17.0
 progress==1.6
 prompt-toolkit==1.0.14
 pycvesearch==1.0.1

From 0621183a8a8aa49a80bc0c52abf4a66730834fb1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Feb 2022 23:01:15 +0000
Subject: [PATCH 04/42] Bump pyrsistent from 0.18.0 to 0.18.1

Bumps [pyrsistent](https://github.com/tobgu/pyrsistent) from 0.18.0 to 0.18.1.
- [Release notes](https://github.com/tobgu/pyrsistent/releases)
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt)
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.18.0...v0.18.1)

---
updated-dependencies:
- dependency-name: pyrsistent
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index f3399259b4..40f26eec9c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -46,7 +46,7 @@ pyfiglet==0.8.post1
 Pygments==2.10.0
 PyInquirer==1.0.3
 pyparsing==2.4.7
-pyrsistent==0.18.0
+pyrsistent==0.18.1
 python-dateutil==2.8.2
 pytoml==0.1.21
 pytz==2021.3

From 34107ac322a4e447786f026dbd1e738e3a1af536 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Feb 2022 14:29:40 -0700
Subject: [PATCH 05/42] update to certutil urlcache and verifyctl

---
 ...ertutil_download_with_urlcache_and_split_arguments.yml | 8 ++++----
 ...rtutil_download_with_verifyctl_and_split_arguments.yml | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index af05ba2894..20168a30e2 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -1,7 +1,7 @@
 name: CertUtil Download With URLCache and Split Arguments
 id: 415b4306-8bfb-11eb-85c4-acde48001122
-version: 2
-date: '2021-03-23'
+version: 3
+date: '2022-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -14,8 +14,8 @@ description: Certutil.exe may download a file from a remote destination using `-
   During triage, capture any files on disk and review. Review the reputation of the
   remote IP or domain in question.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache*
-  Processes.process=*split* by Processes.dest Processes.user Processes.parent_process
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
+  Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.original_file_name
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index d35aa4fa46..65fef131a1 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -1,7 +1,7 @@
 name: CertUtil Download With VerifyCtl and Split Arguments
 id: 801ad9e4-8bfb-11eb-8b31-acde48001122
-version: 2
-date: '2021-03-23'
+version: 3
+date: '2022-02-03'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -14,8 +14,8 @@ description: 'Certutil.exe may download a file from a remote destination using `
   the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
   written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl*
-  Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
+  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'

From bd28a6c92a876913154505fb2a9336f06c4660fd Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 7 Feb 2022 11:10:57 -0700
Subject: [PATCH 06/42] Update pull_request_template.md

---
 .github/pull_request_template.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index fb03d2ad8e..5f3e558c43 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -8,3 +8,5 @@ For Reviewers:
 - [ ] Validate SPL logic.
 - [ ] Validate tags, description, and how to implement.
 - [ ] Validate name patches `<platform>_<mitre att&ck technique>_<short description>`
+- [ ] Verify references match analytic.
+- [ ] Is there an Atomic Test?
\ No newline at end of file

From e7eab5af710fb0ac84967495334487e1ad912eab Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 7 Feb 2022 14:45:37 -0800
Subject: [PATCH 07/42] push

---
 .../{ => endpoint}/ssa___disable_defender_antivirus_registry.yml  | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename detections/experimental/{ => endpoint}/ssa___disable_defender_antivirus_registry.yml (100%)

diff --git a/detections/experimental/ssa___disable_defender_antivirus_registry.yml b/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml
similarity index 100%
rename from detections/experimental/ssa___disable_defender_antivirus_registry.yml
rename to detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml

From 0fa295eee0b8996bb9cf55614dbd647b6c80541b Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 9 Feb 2022 08:01:49 -0700
Subject: [PATCH 08/42] Ordinal

---
 .../rundll_loading_dll_by_ordinal.yml         | 29 ++++++++++---------
 .../rundll_loading_dll_by_ordinal.test.yml    | 12 ++++++++
 2 files changed, 27 insertions(+), 14 deletions(-)
 rename detections/{deprecated => endpoint}/rundll_loading_dll_by_ordinal.yml (65%)
 create mode 100644 tests/endpoint/rundll_loading_dll_by_ordinal.test.yml

diff --git a/detections/deprecated/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
similarity index 65%
rename from detections/deprecated/rundll_loading_dll_by_ordinal.yml
rename to detections/endpoint/rundll_loading_dll_by_ordinal.yml
index 1a42db412b..4e2fcc0b6d 100644
--- a/detections/deprecated/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -1,37 +1,38 @@
 name: RunDLL Loading DLL By Ordinal
 id: 6c135f8d-5e60-454e-80b7-c56eed739833
-version: 5
-date: '2020-11-30'
-author: David Dorsey, Splunk
+version: 6
+date: '2022-02-08'
+author: Michael Haag, David Dorsey, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search looks for executing scripts with rundll32. Adversaries may
+description: The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may
   abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice
   executing directly, may avoid triggering security tools that may not monitor execution
   of the rundll32.exe process because of allowlists or false positives from normal
-  operations.
+  operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_rundll32` by Processes.process_name Processes.parent_process_name
-  Processes.original_file_name Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter`'
+  where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") | `rundll_loading_dll_by_ordinal_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: While not common, loading a DLL under %AppData% and calling
-  a function by ordinal is possible by a legitimate process
-references: []
+known_false_positives: False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
+references:
+  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ 
 tags:
   analytic_story:
   - Unusual Processes
+  - Suspicious Rundll32 Activity
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
   - CIS 8
-  confidence: 100
+  confidence: 70
   context:
   - source:endpoint
   - stage: Defense Evasion
@@ -41,7 +42,7 @@ tags:
   kill_chain_phases:
   - Installation
   message: A rundll32 process $process_name$ with ordinal parameter like this process
-    commandline $process$ in host $dest$
+    commandline $process$ on host $dest$.
   mitre_attack_id:
   - T1218
   - T1218.011
@@ -74,5 +75,5 @@ tags:
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
-  risk_score: 70
+  risk_score: 49
   security_domain: endpoint
diff --git a/tests/endpoint/rundll_loading_dll_by_ordinal.test.yml b/tests/endpoint/rundll_loading_dll_by_ordinal.test.yml
new file mode 100644
index 0000000000..cd20cfb719
--- /dev/null
+++ b/tests/endpoint/rundll_loading_dll_by_ordinal.test.yml
@@ -0,0 +1,12 @@
+name: RunDLL Loading DLL By Ordinal Unit Test
+tests:
+- name: RunDLL Loading DLL By Ordinal
+  file: endpoint/rundll_loading_dll_by_ordinal.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 2fdc53b85b7c3cf6b726c286d3a78d8344c57dfc Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 9 Feb 2022 12:10:58 -0700
Subject: [PATCH 09/42] MSRA shipment :postbox:

---
 ...ows_remote_assistance_spawning_process.yml | 69 +++++++++++++++++++
 ...emote_assistance_spawning_process.test.yml | 12 ++++
 2 files changed, 81 insertions(+)
 create mode 100644 detections/endpoint/windows_remote_assistance_spawning_process.yml
 create mode 100644 tests/endpoint/windows_remote_assistance_spawning_process.test.yml

diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml
new file mode 100644
index 0000000000..1c878a0f37
--- /dev/null
+++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml
@@ -0,0 +1,69 @@
+name: Windows Remote Assistance Spawning Process
+id: ced50492-8849-11ec-9f68-acde48001122
+version: 1
+date: '2022-02-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected.
+  This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe
+  `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited, filter as needed. Add additional shells as needed.
+references:
+  - 
+tags:
+  analytic_story:
+  - Unusual Processes
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/windows_remote_assistance_spawning_process.test.yml b/tests/endpoint/windows_remote_assistance_spawning_process.test.yml
new file mode 100644
index 0000000000..6c7fa9efce
--- /dev/null
+++ b/tests/endpoint/windows_remote_assistance_spawning_process.test.yml
@@ -0,0 +1,12 @@
+name: Windows Remote Assistance Spawning Process Unit Test
+tests:
+- name: Windows Remote Assistance Spawning Process
+  file: endpoint/windows_remote_assistance_spawning_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: msra-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 455d70e3ed0181bfa90246d84e7ff51cef270c5d Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 9 Feb 2022 12:14:25 -0700
Subject: [PATCH 10/42] Update windows_remote_assistance_spawning_process.yml

---
 .../endpoint/windows_remote_assistance_spawning_process.yml     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml
index 1c878a0f37..55a49c7865 100644
--- a/detections/endpoint/windows_remote_assistance_spawning_process.yml
+++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml
@@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited, filter as needed. Add additional shells as needed.
 references:
-  - 
+  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Unusual Processes

From c4629f483a80cd818ba3ba7c62b2244724f74ebe Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 10 Feb 2022 00:27:55 +0000
Subject: [PATCH 11/42] Bump semantic-version from 2.8.5 to 2.9.0

Bumps [semantic-version](https://github.com/rbarrois/python-semanticversion) from 2.8.5 to 2.9.0.
- [Release notes](https://github.com/rbarrois/python-semanticversion/releases)
- [Changelog](https://github.com/rbarrois/python-semanticversion/blob/master/ChangeLog)
- [Commits](https://github.com/rbarrois/python-semanticversion/compare/2.8.5...2.9.0)

---
updated-dependencies:
- dependency-name: semantic-version
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index f3399259b4..5fa8a76a2a 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -46,7 +46,7 @@ pyfiglet==0.8.post1
 Pygments==2.10.0
 PyInquirer==1.0.3
 pyparsing==2.4.7
-pyrsistent==0.18.0
+pyrsistent==0.18.1
 python-dateutil==2.8.2
 pytoml==0.1.21
 pytz==2021.3
@@ -56,7 +56,7 @@ regex==2021.11.10
 requests==2.26.0
 retrying==1.3.3
 scandir==1.10.0
-semantic-version==2.8.5
+semantic-version==2.9.0
 simplejson==3.17.6
 six==1.16.0
 sly==0.4

From e3d1ae9be7ffd0e0fb971a61e0686964aa591824 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 10 Feb 2022 00:28:52 +0000
Subject: [PATCH 12/42] Bump urllib3 from 1.26.6 to 1.26.8

Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.6 to 1.26.8.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/1.26.6...1.26.8)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index f3399259b4..fd6ff5fa83 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -46,7 +46,7 @@ pyfiglet==0.8.post1
 Pygments==2.10.0
 PyInquirer==1.0.3
 pyparsing==2.4.7
-pyrsistent==0.18.0
+pyrsistent==0.18.1
 python-dateutil==2.8.2
 pytoml==0.1.21
 pytz==2021.3
@@ -69,7 +69,7 @@ toml==0.10.2
 tomli==1.2.2
 typing==3.7.4.3
 tzlocal==4.1
-urllib3==1.26.6
+urllib3==1.26.8
 virtualenv==20.12.1
 wcwidth==0.2.5
 webencodings==0.5.1

From b31ee54c206eb8f2a013d354197707fb0dcbaac1 Mon Sep 17 00:00:00 2001
From: Xiao Lin <xlin@splunk.com>
Date: Thu, 20 Jan 2022 19:30:11 -0800
Subject: [PATCH 13/42] Unusual Volume of Data Download from Internal Server
 Per Entity

---
 ...l_volume_download_from_internal_server.yml | 68 +++++++++++++++++++
 ...ume_download_from_internal_server.test.yml | 13 ++++
 2 files changed, 81 insertions(+)
 create mode 100644 detections/network/ssa___unusual_volume_download_from_internal_server.yml
 create mode 100644 tests/network/ssa___unusual_volume_download_from_internal_server.test.yml

diff --git a/detections/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/network/ssa___unusual_volume_download_from_internal_server.yml
new file mode 100644
index 0000000000..0c24720ca0
--- /dev/null
+++ b/detections/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -0,0 +1,68 @@
+name: Unusual Volume of Data Download from Internal Server Per Entity
+id: cca028f4-77dd-11ec-bc09-acde48001122
+version: 1
+date: '2022-01-17'
+author: Xiao Lin, Splunk
+type: Anomaly
+datamodel:
+- Network_Traffic
+description: Insider might conduct information collection before data exfiltration, and unusual volume of data
+  download from internal server is an indicator of such potential threat. This detection evaluates the total 
+  bytes downloaded from internal servers at specific time window per entity level, and then flagged these that 
+  are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte 
+  volume is unusual even though that operation is benigh, which causes false positive. It is therefore advised 
+  to adjust threshold and time window based on detection performance whenever necessary. It should be noted that 
+  seasonality is not modeled in the current approach.
+search: '| from read_ssa_enriched_events() 
+  | eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null)
+  | where sourcetype == "pan:traffic"
+  | eval dest_device = map_get(input_event, "dest_device_ips")
+  | where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL"
+  | eval src_device = map_get(input_event, "source_device_ips")
+  | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
+  | eval download_bytes = map_get(input_event, "bytes_in")
+  | where download_bytes IS NOT NULL
+  | eval tenant = map_get(input_event, "_tenant"), event_id = map_get(input_event, "event_id")
+  | adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" threshold=0.001 window=86400L
+  | eval end_time = _time
+  | eval start_time = end_time - 86400
+  | eval body = create_map(["event_id", event_id, "tenant", tenant])
+  | select start_time, end_time, dest_device, label, body
+  | into write_ssa_detected_events();'
+how_to_implement: ingest PAN traffic logs 
+known_false_positives: benigh large volume data download might be flagged as (false) positive.
+references:
+- https://github.com/twitter/AnomalyDetection
+tags:
+  analytic_story:
+  -  insider threat detection, information collection
+  dataset:
+  - https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_volume_data_download.txt
+  kill_chain_phases:
+  - Weaponization
+  mitre_attack_id:
+  - T1213
+  - T1039
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_scope
+  - bytes_in
+  - src_device_ips
+  security_domain: network
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  risk_severity: low
+  context:
+  message: $src_device_ip downloaded unusually amount of data from internal server within one day
+  observable:
+    - name: src_device_ip
+      type: Host IP
+      role:
+    - Others
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 13
\ No newline at end of file
diff --git a/tests/network/ssa___unusual_volume_download_from_internal_server.test.yml b/tests/network/ssa___unusual_volume_download_from_internal_server.test.yml
new file mode 100644
index 0000000000..907f064f1e
--- /dev/null
+++ b/tests/network/ssa___unusual_volume_download_from_internal_server.test.yml
@@ -0,0 +1,13 @@
+name: Unusual Volume of Data Download from Internal Server Per Entity - SSA Unit Test
+tests:
+- name: Unusual Volume of Data Download from Internal Server Per Entity
+  file: network/ssa___unusual_volume_download_from_internal_server.yml
+  pass_condition: '| stats count | where count > 0'
+  description: Test unusual volume of data download from internal server per entity
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: unusual_volume_data_download.txt
+    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_volume_data_download.txt
+    source: PAN Traffic Log
+    sourcetype: 'pan:traffic'
\ No newline at end of file

From 62ab57673386cc275a6cdbf07a6edca2147c2a3a Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 9 Feb 2022 12:06:59 -0800
Subject: [PATCH 14/42] Update
 ssa___unusual_volume_download_from_internal_server.yml

---
 ...ssa___unusual_volume_download_from_internal_server.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/network/ssa___unusual_volume_download_from_internal_server.yml
index 0c24720ca0..bcee2070cb 100644
--- a/detections/network/ssa___unusual_volume_download_from_internal_server.yml
+++ b/detections/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -29,13 +29,13 @@ search: '| from read_ssa_enriched_events()
   | eval body = create_map(["event_id", event_id, "tenant", tenant])
   | select start_time, end_time, dest_device, label, body
   | into write_ssa_detected_events();'
-how_to_implement: ingest PAN traffic logs 
-known_false_positives: benigh large volume data download might be flagged as (false) positive.
+how_to_implement: Ingest PAN traffic logs 
+known_false_positives: Benig large volume data download might be flagged as (false) positive.
 references:
 - https://github.com/twitter/AnomalyDetection
 tags:
   analytic_story:
-  -  insider threat detection, information collection
+  - Insider Threat
   dataset:
   - https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_volume_data_download.txt
   kill_chain_phases:
@@ -65,4 +65,4 @@ tags:
   nist:
   - DE.AE
   cis20:
-  - CIS 13
\ No newline at end of file
+  - CIS 13

From ddd492fe23595d3219bb4287aa0f769770f08686 Mon Sep 17 00:00:00 2001
From: Xiao Lin <xlin@splunk.com>
Date: Wed, 9 Feb 2022 14:23:27 -0800
Subject: [PATCH 15/42] update data link to attack_range, move detection to
 experimental

---
 .../ssa___unusual_volume_download_from_internal_server.yml    | 2 +-
 ...sa___unusual_volume_download_from_internal_server.test.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename detections/{ => experimental}/network/ssa___unusual_volume_download_from_internal_server.yml (95%)
 rename tests/{network => experimental}/ssa___unusual_volume_download_from_internal_server.test.yml (67%)

diff --git a/detections/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
similarity index 95%
rename from detections/network/ssa___unusual_volume_download_from_internal_server.yml
rename to detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
index bcee2070cb..786de16d3d 100644
--- a/detections/network/ssa___unusual_volume_download_from_internal_server.yml
+++ b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -37,7 +37,7 @@ tags:
   analytic_story:
   - Insider Threat
   dataset:
-  - https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_volume_data_download.txt
+  - https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
   kill_chain_phases:
   - Weaponization
   mitre_attack_id:
diff --git a/tests/network/ssa___unusual_volume_download_from_internal_server.test.yml b/tests/experimental/ssa___unusual_volume_download_from_internal_server.test.yml
similarity index 67%
rename from tests/network/ssa___unusual_volume_download_from_internal_server.test.yml
rename to tests/experimental/ssa___unusual_volume_download_from_internal_server.test.yml
index 907f064f1e..f7a54963c3 100644
--- a/tests/network/ssa___unusual_volume_download_from_internal_server.test.yml
+++ b/tests/experimental/ssa___unusual_volume_download_from_internal_server.test.yml
@@ -1,13 +1,13 @@
 name: Unusual Volume of Data Download from Internal Server Per Entity - SSA Unit Test
 tests:
 - name: Unusual Volume of Data Download from Internal Server Per Entity
-  file: network/ssa___unusual_volume_download_from_internal_server.yml
+  file: experimental/network/ssa___unusual_volume_download_from_internal_server.yml
   pass_condition: '| stats count | where count > 0'
   description: Test unusual volume of data download from internal server per entity
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
   - file_name: unusual_volume_data_download.txt
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_volume_data_download.txt
+    data: https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
     source: PAN Traffic Log
     sourcetype: 'pan:traffic'
\ No newline at end of file

From 9a04a4e833538e184e2ce72aa5d6db49d5cc1316 Mon Sep 17 00:00:00 2001
From: Xiao Lin <xlin@splunk.com>
Date: Wed, 9 Feb 2022 14:54:23 -0800
Subject: [PATCH 16/42] fix a typo

---
 .../ssa___unusual_volume_download_from_internal_server.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
index 786de16d3d..ec1f51e299 100644
--- a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
+++ b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -30,7 +30,7 @@ search: '| from read_ssa_enriched_events()
   | select start_time, end_time, dest_device, label, body
   | into write_ssa_detected_events();'
 how_to_implement: Ingest PAN traffic logs 
-known_false_positives: Benig large volume data download might be flagged as (false) positive.
+known_false_positives: Benign large volume data download might be flagged as (false) positive.
 references:
 - https://github.com/twitter/AnomalyDetection
 tags:

From a1e6d3e2257aba33e867dde25877751ecd92ab43 Mon Sep 17 00:00:00 2001
From: Xiao Lin <xlin@splunk.com>
Date: Wed, 9 Feb 2022 15:45:33 -0800
Subject: [PATCH 17/42] update search string

---
 ...ssa___unusual_volume_download_from_internal_server.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
index ec1f51e299..a782af9c45 100644
--- a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
+++ b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -15,16 +15,20 @@ description: Insider might conduct information collection before data exfiltrati
   seasonality is not modeled in the current approach.
 search: '| from read_ssa_enriched_events() 
   | eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null)
+  | eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | where sourcetype == "pan:traffic"
+  | eval src_device_scope = map_get(input_event, "src_device_scope")
+  | eval dest_device_scope = map_get(input_event, "src_device_scope")
+  | where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL
   | eval dest_device = map_get(input_event, "dest_device_ips")
   | where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL"
   | eval src_device = map_get(input_event, "source_device_ips")
   | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
-  | eval download_bytes = map_get(input_event, "bytes_in")
+  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string", null))
   | where download_bytes IS NOT NULL
   | eval tenant = map_get(input_event, "_tenant"), event_id = map_get(input_event, "event_id")
   | adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" threshold=0.001 window=86400L
-  | eval end_time = _time
+  | eval end_time = timestamp
   | eval start_time = end_time - 86400
   | eval body = create_map(["event_id", event_id, "tenant", tenant])
   | select start_time, end_time, dest_device, label, body

From 4c5f48c507dca93758691bb82136d9205d66da07 Mon Sep 17 00:00:00 2001
From: Xiao Lin <xlin@splunk.com>
Date: Wed, 9 Feb 2022 16:40:45 -0800
Subject: [PATCH 18/42] add detection for unusal volume of data download

---
 ...al_volume_download_from_internal_server.test.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 tests/experimental/network/ssa___unusual_volume_download_from_internal_server.test.yml

diff --git a/tests/experimental/network/ssa___unusual_volume_download_from_internal_server.test.yml b/tests/experimental/network/ssa___unusual_volume_download_from_internal_server.test.yml
new file mode 100644
index 0000000000..f7a54963c3
--- /dev/null
+++ b/tests/experimental/network/ssa___unusual_volume_download_from_internal_server.test.yml
@@ -0,0 +1,13 @@
+name: Unusual Volume of Data Download from Internal Server Per Entity - SSA Unit Test
+tests:
+- name: Unusual Volume of Data Download from Internal Server Per Entity
+  file: experimental/network/ssa___unusual_volume_download_from_internal_server.yml
+  pass_condition: '| stats count | where count > 0'
+  description: Test unusual volume of data download from internal server per entity
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: unusual_volume_data_download.txt
+    data: https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
+    source: PAN Traffic Log
+    sourcetype: 'pan:traffic'
\ No newline at end of file

From ee2ee9874235c1ad81f92874f9bc83afccc9df74 Mon Sep 17 00:00:00 2001
From: Xiao Lin <xlin@splunk.com>
Date: Wed, 9 Feb 2022 16:44:17 -0800
Subject: [PATCH 19/42] remove duplicate

---
 ...al_volume_download_from_internal_server.test.yml | 13 -------------
 1 file changed, 13 deletions(-)
 delete mode 100644 tests/experimental/ssa___unusual_volume_download_from_internal_server.test.yml

diff --git a/tests/experimental/ssa___unusual_volume_download_from_internal_server.test.yml b/tests/experimental/ssa___unusual_volume_download_from_internal_server.test.yml
deleted file mode 100644
index f7a54963c3..0000000000
--- a/tests/experimental/ssa___unusual_volume_download_from_internal_server.test.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: Unusual Volume of Data Download from Internal Server Per Entity - SSA Unit Test
-tests:
-- name: Unusual Volume of Data Download from Internal Server Per Entity
-  file: experimental/network/ssa___unusual_volume_download_from_internal_server.yml
-  pass_condition: '| stats count | where count > 0'
-  description: Test unusual volume of data download from internal server per entity
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: unusual_volume_data_download.txt
-    data: https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
-    source: PAN Traffic Log
-    sourcetype: 'pan:traffic'
\ No newline at end of file

From baab60365787975d78fc6af4c02b89244bfd6f58 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 9 Feb 2022 16:45:28 -0800
Subject: [PATCH 20/42] Update
 ssa___unusual_volume_download_from_internal_server.yml

---
 .../ssa___unusual_volume_download_from_internal_server.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
index a782af9c45..e87ce92d78 100644
--- a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
+++ b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -65,7 +65,7 @@ tags:
     - name: src_device_ip
       type: Host IP
       role:
-    - Others
+      - Others
   nist:
   - DE.AE
   cis20:

From 40b34450a079a12d3f1236befee50c5553f12f2d Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 10 Feb 2022 09:08:52 -0700
Subject: [PATCH 21/42] Windows Schtasks Create Run As System

---
 .../windows_schtasks_create_run_as_system.yml | 69 +++++++++++++++++++
 ...ows_schtasks_create_run_as_system.test.yml | 12 ++++
 2 files changed, 81 insertions(+)
 create mode 100644 detections/endpoint/windows_schtasks_create_run_as_system.yml
 create mode 100644 tests/endpoint/windows_schtasks_create_run_as_system.test.yml

diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml
new file mode 100644
index 0000000000..0015b46db9
--- /dev/null
+++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml
@@ -0,0 +1,69 @@
+name: Windows Schtasks Create Run As System
+id: 41a0e58e-884c-11ec-9976-acde48001122
+version: 1
+date: '2022-02-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. 
+  This is commonly used by adversaries to spawn a process in an elevated state. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_schtasks`
+  Processes.process="*//create *" AND Processes.process="*//ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_schtasks_create_run_as_system_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+references:
+  - https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
+  - https://www.ired.team/offensive-security/persistence/t1053-schtask
+  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1053.005
+  - T1053
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 60
+  # (impact * confidence)/100
+  risk_score: 48
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/windows_schtasks_create_run_as_system.test.yml b/tests/endpoint/windows_schtasks_create_run_as_system.test.yml
new file mode 100644
index 0000000000..01e7e8f290
--- /dev/null
+++ b/tests/endpoint/windows_schtasks_create_run_as_system.test.yml
@@ -0,0 +1,12 @@
+name: Windows Schtasks Create Run As System Unit Test
+tests:
+- name: Windows Schtasks Create Run As System
+  file: endpoint/windows_schtasks_create_run_as_system.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From 55e94c3eab49d491542d43782e3f757d43204246 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 10 Feb 2022 09:04:04 -0800
Subject: [PATCH 22/42] Now, failing one or more CI/CD Tests causes the
 workflow to fail. An additional file is also uploaded called
 "replicate_failures" which allows the user to easily retest just the failed
 tests locally.

---
 .../ci/detection_testing_batch/summarize_json.py            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py b/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py
index d2912773cf..b9d5a9d822 100644
--- a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py
+++ b/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py
@@ -87,9 +87,9 @@ def print_summary(test_count: int, pass_count:int, fail_count:int, error_count:i
 def exit_with_status(test_pass:bool, test_count: int, pass_count:int, fail_count:int, error_count:int)->None:
     if not test_pass:
         print("Result: FAIL")
-        print("DURING TESTING, THIS WILL STILL EXIT WITH AN EXIT CODE OF 0 (SUCCESS) TO ALLOW THE WORKFLOW "
-              "TO PASS AND CI/CD TO CONTINUE.  THIS WILL BE CHANGED IN A FUTURE VERSION.")
-        sys.exit(0)
+        #print("DURING TESTING, THIS WILL STILL EXIT WITH AN EXIT CODE OF 0 (SUCCESS) TO ALLOW THE WORKFLOW "
+        #      "TO PASS AND CI/CD TO CONTINUE.  THIS WILL BE CHANGED IN A FUTURE VERSION.")
+        #sys.exit(0)
         sys.exit(1)
     else:
         print("Result: PASS!")

From 428785a15fda22ad7eb13cdca0b35aa26c84dc7f Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 10 Feb 2022 09:07:02 -0800
Subject: [PATCH 23/42] Revert "Now, failing one or more CI/CD Tests causes"

This reverts commit 55e94c3eab49d491542d43782e3f757d43204246.
---
 .../ci/detection_testing_batch/summarize_json.py            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py b/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py
index b9d5a9d822..d2912773cf 100644
--- a/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py
+++ b/bin/automated_detection_testing/ci/detection_testing_batch/summarize_json.py
@@ -87,9 +87,9 @@ def print_summary(test_count: int, pass_count:int, fail_count:int, error_count:i
 def exit_with_status(test_pass:bool, test_count: int, pass_count:int, fail_count:int, error_count:int)->None:
     if not test_pass:
         print("Result: FAIL")
-        #print("DURING TESTING, THIS WILL STILL EXIT WITH AN EXIT CODE OF 0 (SUCCESS) TO ALLOW THE WORKFLOW "
-        #      "TO PASS AND CI/CD TO CONTINUE.  THIS WILL BE CHANGED IN A FUTURE VERSION.")
-        #sys.exit(0)
+        print("DURING TESTING, THIS WILL STILL EXIT WITH AN EXIT CODE OF 0 (SUCCESS) TO ALLOW THE WORKFLOW "
+              "TO PASS AND CI/CD TO CONTINUE.  THIS WILL BE CHANGED IN A FUTURE VERSION.")
+        sys.exit(0)
         sys.exit(1)
     else:
         print("Result: PASS!")

From ace7ccbb6dde2a7d78828dd419af693651f35547 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 10 Feb 2022 11:36:02 -0700
Subject: [PATCH 24/42] Update windows_schtasks_create_run_as_system.yml

---
 detections/endpoint/windows_schtasks_create_run_as_system.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml
index 0015b46db9..c7fff79e68 100644
--- a/detections/endpoint/windows_schtasks_create_run_as_system.yml
+++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml
@@ -10,7 +10,7 @@ description: The following analytic identifies Schtasks.exe creating a new task
   This is commonly used by adversaries to spawn a process in an elevated state. 
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_schtasks`
-  Processes.process="*//create *" AND Processes.process="*//ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`

From 73ba1285903b3a79a3f62d941442e0de4c51658d Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Fri, 11 Feb 2022 12:11:10 -0500
Subject: [PATCH 25/42] fixing duplicate lookups bug

---
 bin/doc_gen.py                                               | 5 ++++-
 bin/jinja2_templates/doc_detections.j2                       | 2 ++
 docs/_pages/detections.md                                    | 4 ++--
 .../2017-09-12-detect_new_login_attempts_to_routers.md       | 2 ++
 .../2017-09-13-detect_unauthorized_assets_by_mac_address.md  | 2 ++
 docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md | 2 ++
 .../2017-09-19-email_attachments_with_lots_of_spaces.md      | 2 ++
 docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md    | 2 ++
 ...detect_attackers_scanning_for_vulnerable_jboss_servers.md | 2 ++
 ...-23-detect_malicious_requests_to_exploit_jboss_servers.md | 2 ++
 .../_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md | 2 ++
 docs/_posts/2017-10-13-unusually_long_content-type_length.md | 2 ++
 docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md      | 2 ++
 ...detect_spike_in_blocked_outbound_traffic_from_your_aws.md | 3 ++-
 docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md | 2 ++
 docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md     | 2 ++
 ..._compute_instance_created_with_previously_unseen_image.md | 2 ++
 docs/_posts/2018-10-23-wmi_permanent_event_subscription.md   | 2 ++
 docs/_posts/2018-10-23-wmi_temporary_event_subscription.md   | 2 ++
 docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md | 3 ++-
 docs/_posts/2018-12-03-remote_wmi_command_attempt.md         | 2 ++
 docs/_posts/2018-12-03-usn_journal_deletion.md               | 2 ++
 docs/_posts/2018-12-06-suspicious_java_classes.md            | 2 ++
 docs/_posts/2018-12-14-file_with_samsam_extension.md         | 2 ++
 docs/_posts/2018-12-14-samsam_test_file_write.md             | 2 ++
 docs/_posts/2019-01-25-processes_tapping_keyboard_events.md  | 2 ++
 .../2019-04-01-web_servers_executing_suspicious_processes.md | 2 ++
 docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md | 2 ++
 ...9-12-03-detect_credential_dumping_through_lsass_access.md | 2 ++
 .../_posts/2019-12-03-detect_mimikatz_using_loaded_images.md | 2 ++
 .../2019-12-06-access_lsass_memory_for_dump_creation.md      | 2 ++
 docs/_posts/2019-12-06-create_remote_thread_into_lsass.md    | 2 ++
 docs/_posts/2019-12-10-creation_of_shadow_copy.md            | 2 ++
 docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md   | 2 ++
 docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md    | 2 ++
 .../2020-01-28-monitor_registry_keys_for_print_monitors.md   | 2 ++
 .../2020-01-28-registry_keys_for_creating_shim_databases.md  | 2 ++
 docs/_posts/2020-01-28-sdclt_uac_bypass.md                   | 2 ++
 docs/_posts/2020-01-28-silentcleanup_uac_bypass.md           | 2 ++
 docs/_posts/2020-01-28-wsreset_uac_bypass.md                 | 2 ++
 .../_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md | 2 ++
 docs/_posts/2020-02-07-macos_-_re-opened_applications.md     | 2 ++
 docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md  | 2 ++
 docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md         | 2 ++
 docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md     | 2 ++
 docs/_posts/2020-03-16-detect_rare_executables.md            | 2 ++
 docs/_posts/2020-03-16-process_execution_via_wmi.md          | 2 ++
 docs/_posts/2020-03-16-script_execution_via_wmi.md           | 2 ++
 docs/_posts/2020-03-16-spike_in_file_writes.md               | 2 ++
 ...020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md | 2 ++
 .../2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md   | 2 ++
 .../2020-05-20-first_time_seen_child_process_of_zoom.md      | 2 ++
 ..._cross_account_activity_from_previously_unseen_account.md | 2 ++
 .../2020-05-28-detect_aws_console_login_by_new_user.md       | 2 ++
 ...0-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md | 2 ++
 ...03-detect_path_interception_by_creation_of_program_exe.md | 2 ++
 docs/_posts/2020-07-06-short_lived_windows_accounts.md       | 2 ++
 docs/_posts/2020-07-06-windows_event_log_cleared.md          | 2 ++
 docs/_posts/2020-07-07-remote_desktop_network_traffic.md     | 2 ++
 docs/_posts/2020-07-08-detect_new_local_admin_account.md     | 2 ++
 .../2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md  | 2 ++
 docs/_posts/2020-07-21-attempt_to_stop_security_service.md   | 2 ++
 .../2020-07-21-detect_excessive_user_account_lockouts.md     | 2 ++
 docs/_posts/2020-07-21-detect_outbound_smb_traffic.md        | 2 ++
 .../2020-07-21-detect_outlook_exe_writing_a_zip_file.md      | 2 ++
 ...21-detect_use_of_cmd_exe_to_launch_script_interpreters.md | 2 ++
 .../_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md | 2 ++
 ...1-email_files_written_outside_of_the_outlook_directory.md | 2 ++
 ...-21-email_servers_sending_high_volume_traffic_to_hosts.md | 2 ++
 docs/_posts/2020-07-21-excessive_dns_failures.md             | 2 ++
 .../2020-07-21-first_time_seen_running_windows_service.md    | 2 ++
 ...020-07-21-hiding_files_and_directories_with_attrib_exe.md | 2 ++
 ...iving_high_volume_of_network_traffic_from_email_server.md | 2 ++
 ...malicious_powershell_process_-_execution_policy_bypass.md | 2 ++
 ...e_okta_users_with_invalid_credentials_from_the_same_ip.md | 2 ++
 docs/_posts/2020-07-21-okta_account_lockout_events.md        | 2 ++
 docs/_posts/2020-07-21-okta_failed_sso_attempts.md           | 2 ++
 .../2020-07-21-okta_user_logins_from_multiple_cities.md      | 2 ++
 docs/_posts/2020-07-21-overwriting_accessibility_binaries.md | 2 ++
 docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md | 2 ++
 docs/_posts/2020-07-21-protocol_or_port_mismatch.md          | 2 ++
 docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md  | 2 ++
 .../2020-07-21-remote_desktop_process_running_on_system.md   | 2 ++
 .../2020-07-21-sc_exe_manipulating_windows_services.md       | 2 ++
 docs/_posts/2020-07-21-sql_injection_with_long_urls.md       | 2 ++
 docs/_posts/2020-07-22-smb_traffic_spike.md                  | 2 ++
 docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md           | 2 ++
 .../2020-07-22-suspicious_email_attachment_extensions.md     | 2 ++
 docs/_posts/2020-07-22-suspicious_reg_exe_process.md         | 2 ++
 .../2020-07-22-suspicious_writes_to_windows_recycle_bin.md   | 2 ++
 docs/_posts/2020-07-22-tor_traffic.md                        | 2 ++
 docs/_posts/2020-07-22-unload_sysmon_filter_driver.md        | 2 ++
 docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md   | 2 ++
 docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md  | 2 ++
 docs/_posts/2020-07-27-aws_detect_role_creation.md           | 2 ++
 docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md   | 2 ++
 .../2020-07-27-aws_detect_sts_get_session_token_abuse.md     | 2 ++
 ...2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md | 2 ++
 docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md | 2 ++
 ...7-29-cloud_instance_modified_by_previously_unseen_user.md | 2 ++
 docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md   | 2 ++
 .../_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md | 2 ++
 .../2020-08-10-detect_gcp_storage_access_from_a_new_ip.md    | 3 ++-
 docs/_posts/2020-08-11-detect_arp_poisoning.md               | 2 ++
 docs/_posts/2020-08-11-detect_rogue_dhcp_server.md           | 2 ++
 ...rovisioning_activity_from_previously_unseen_ip_address.md | 2 ++
 ...ud_provisioning_activity_from_previously_unseen_region.md | 2 ++
 ...21-abnormally_high_number_of_cloud_instances_destroyed.md | 2 ++
 ...-21-abnormally_high_number_of_cloud_instances_launched.md | 2 ++
 ...shing_email_detection_by_machine_learning_method_-_ssa.md | 2 ++
 ...-08-25-system_process_running_from_unexpected_location.md | 2 ++
 .../2020-08-25-unusual_lolbas_in_short_period_of_time.md     | 2 ++
 ...d_compute_instance_created_in_previously_unused_region.md | 2 ++
 ...9-04-cloud_api_calls_from_previously_unseen_user_roles.md | 2 ++
 ...normally_high_number_of_cloud_infrastructure_api_calls.md | 2 ++
 ...normally_high_number_of_cloud_security_group_api_calls.md | 2 ++
 ..._instance_created_with_previously_unseen_instance_type.md | 2 ++
 docs/_posts/2020-09-15-detect_zerologon_via_zeek.md          | 2 ++
 ...20-09-16-create_or_delete_windows_shares_using_net_exe.md | 2 ++
 ...0-09-18-detect_computer_changed_with_anonymous_account.md | 2 ++
 ...0-10-07-detect_aws_console_login_by_user_from_new_city.md | 2 ++
 ...0-07-detect_aws_console_login_by_user_from_new_country.md | 2 ++
 ...10-07-detect_aws_console_login_by_user_from_new_region.md | 2 ++
 docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md       | 2 ++
 ...loud_provisioning_activity_from_previously_unseen_city.md | 2 ++
 ...d_provisioning_activity_from_previously_unseen_country.md | 2 ++
 ...10-15-detect_activity_related_to_pass_the_hash_attacks.md | 2 ++
 ...20-10-16-kerberoasting_spn_request_with_rc4_encryption.md | 2 ++
 docs/_posts/2020-10-21-detect_kerberoasting.md               | 2 ++
 docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md     | 2 ++
 .../2020-10-28-detect_ipv6_network_infrastructure_threats.md | 2 ++
 docs/_posts/2020-10-28-detect_port_security_violation.md     | 2 ++
 .../2020-10-28-detect_software_download_to_network_device.md | 2 ++
 docs/_posts/2020-10-28-detect_traffic_mirroring.md           | 2 ++
 docs/_posts/2020-11-06-ryuk_test_files_detected.md           | 2 ++
 ..._powershell_execution_policy_to_unrestricted_or_bypass.md | 2 ++
 .../2020-11-06-windows_security_account_manager_stopped.md   | 2 ++
 docs/_posts/2020-11-09-common_ransomware_extensions.md       | 2 ++
 docs/_posts/2020-11-09-common_ransomware_notes.md            | 2 ++
 docs/_posts/2020-11-09-deleting_shadow_copies.md             | 2 ++
 ...-11-09-detect_excessive_account_lockouts_from_endpoint.md | 2 ++
 ...cesses_used_for_system_network_configuration_discovery.md | 2 ++
 ...-11-10-detect_prohibited_applications_spawning_cmd_exe.md | 2 ++
 .../2020-11-18-disabling_remote_user_account_control.md      | 2 ++
 .../2020-11-18-execution_of_file_with_multiple_extensions.md | 2 ++
 ...-shim_database_installation_with_suspicious_parameters.md | 2 ++
 ...26-reg_exe_manipulating_windows_services_registry_keys.md | 2 ++
 docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md | 2 ++
 docs/_posts/2020-12-08-shim_database_file_creation.md        | 2 ++
 docs/_posts/2020-12-08-single_letter_process_on_endpoint.md  | 2 ++
 ...0-12-08-system_processes_run_from_unexpected_locations.md | 2 ++
 docs/_posts/2020-12-08-unusually_long_command_line.md        | 2 ++
 .../2020-12-08-wmi_permanent_event_subscription_-_sysmon.md  | 2 ++
 .../2020-12-14-sunburst_correlation_dll_and_network_event.md | 2 ++
 docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md  | 2 ++
 ...-16-high_number_of_login_failures_from_a_single_source.md | 2 ++
 ...020-12-16-o365_excessive_authentication_failures_alert.md | 2 ++
 docs/_posts/2020-12-16-o365_pst_export_alert.md              | 2 ++
 .../2020-12-16-o365_suspicious_admin_email_forwarding.md     | 2 ++
 .../2020-12-16-o365_suspicious_user_email_forwarding.md      | 2 ++
 .../2020-12-17-scheduled_task_deleted_or_created_via_cmd.md  | 2 ++
 .../2020-12-21-bcdedit_failure_recovery_modification.md      | 2 ++
 docs/_posts/2021-01-06-supernova_webshell.md                 | 2 ++
 ...ct_users_creating_keys_with_encrypt_policy_without_mfa.md | 2 ++
 ...ws_detect_users_with_kms_keys_performing_encryption_s3.md | 2 ++
 ...etwork_access_control_list_created_with_all_open_ports.md | 2 ++
 .../2021-01-12-aws_network_access_control_list_deleted.md    | 2 ++
 ...021-01-12-suspicious_microsoft_workflow_compiler_usage.md | 2 ++
 docs/_posts/2021-01-12-suspicious_msbuild_path.md            | 2 ++
 docs/_posts/2021-01-12-suspicious_msbuild_rename.md          | 2 ++
 docs/_posts/2021-01-12-suspicious_msbuild_spawn.md           | 2 ++
 docs/_posts/2021-01-12-suspicious_mshta_child_process.md     | 2 ++
 ...14-detect_hosts_connecting_to_dynamic_domain_providers.md | 2 ++
 ...licious_powershell_process_with_obfuscation_techniques.md | 2 ++
 .../2021-01-20-detect_rundll32_inline_hta_execution.md       | 2 ++
 docs/_posts/2021-01-20-suspicious_mshta_spawn.md             | 2 ++
 docs/_posts/2021-01-22-wbadmin_delete_system_backups.md      | 2 ++
 docs/_posts/2021-01-25-nltest_domain_trust_discovery.md      | 2 ++
 ...1-01-26-aws_saml_access_by_provider_user_and_principal.md | 2 ++
 docs/_posts/2021-01-26-aws_saml_update_identity_provider.md  | 2 ++
 .../_posts/2021-01-26-certutil_exe_certificate_extraction.md | 2 ++
 ...tect_spike_in_aws_security_hub_alerts_for_ec2_instance.md | 2 ++
 ...01-26-detect_spike_in_aws_security_hub_alerts_for_user.md | 2 ++
 .../2021-01-26-o365_add_app_role_assignment_grant_user.md    | 2 ++
 docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md    | 2 ++
 docs/_posts/2021-01-26-o365_new_federated_domain_added.md    | 2 ++
 docs/_posts/2021-01-26-revil_registry_entry.md               | 2 ++
 docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md | 2 ++
 ...1-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md | 2 ++
 .../2021-01-28-detect_regsvr32_application_control_bypass.md | 2 ++
 docs/_posts/2021-01-28-ntdsutil_export_ntds.md               | 2 ++
 ...021-01-28-suspicious_regsvr32_register_suspicious_path.md | 2 ++
 ...2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md | 2 ++
 ...4-detect_rundll32_application_control_bypass_-_advpack.md | 2 ++
 ...-detect_rundll32_application_control_bypass_-_setupapi.md | 2 ++
 ...-detect_rundll32_application_control_bypass_-_syssetup.md | 2 ++
 docs/_posts/2021-02-04-suspicious_rundll32_startw.md         | 2 ++
 .../2021-02-09-suspicious_rundll32_dllregisterserver.md      | 2 ++
 .../2021-02-11-detect_html_help_spawn_child_process.md       | 2 ++
 docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md   | 2 ++
 docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md  | 2 ++
 .../2021-02-16-detect_regasm_with_network_connection.md      | 2 ++
 .../2021-02-16-detect_regsvcs_with_network_connection.md     | 2 ++
 ...02-22-aws_create_policy_version_to_allow_all_resources.md | 2 ++
 docs/_posts/2021-02-22-cobalt_strike_named_pipes.md          | 2 ++
 docs/_posts/2021-02-22-suspicious_curl_network_connection.md | 2 ++
 docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md        | 2 ++
 .../2021-02-22-suspicious_plistbuddy_usage_via_osquery.md    | 2 ++
 .../2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md   | 2 ++
 docs/_posts/2021-03-01-any_powershell_downloadfile.md        | 2 ++
 docs/_posts/2021-03-01-any_powershell_downloadstring.md      | 2 ++
 docs/_posts/2021-03-01-fodhelper_uac_bypass.md               | 2 ++
 docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md           | 2 ++
 ...-03-01-suspicious_scheduled_task_from_public_directory.md | 2 ++
 docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md        | 2 ++
 ...021-03-02-unified_messaging_service_spawning_a_process.md | 2 ++
 .../_posts/2021-03-02-windows_disableantispyware_registry.md | 2 ++
 docs/_posts/2021-03-03-nishang_powershelltcponeline.md       | 2 ++
 docs/_posts/2021-03-03-w3wp_spawning_shell.md                | 2 ++
 docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md     | 2 ++
 docs/_posts/2021-03-12-resize_shadowstorage_volume.md        | 2 ++
 docs/_posts/2021-03-16-high_file_deletion_frequency.md       | 2 ++
 docs/_posts/2021-03-16-high_process_termination_frequency.md | 2 ++
 docs/_posts/2021-03-17-clop_common_exec_parameter.md         | 2 ++
 docs/_posts/2021-03-17-clop_ransomware_known_service_name.md | 2 ++
 .../2021-03-17-process_deleting_its_process_file_path.md     | 2 ++
 ...23-certutil_download_with_urlcache_and_split_arguments.md | 2 ++
 ...3-certutil_download_with_verifyctl_and_split_arguments.md | 2 ++
 docs/_posts/2021-03-23-certutil_with_decode_argument.md      | 2 ++
 docs/_posts/2021-03-29-powershell_start-bitstransfer.md      | 2 ++
 docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md  | 2 ++
 docs/_posts/2021-03-31-disabling_firewall_with_netsh.md      | 2 ++
 docs/_posts/2021-03-31-dsquery_domain_discovery.md           | 2 ++
 .../2021-04-01-aws_iam_assume_role_policy_brute_force.md     | 2 ++
 docs/_posts/2021-04-01-aws_iam_delete_policy.md              | 2 ++
 docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md     | 2 ++
 .../2021-04-07-malicious_powershell_executed_as_a_service.md | 2 ++
 ...users_failing_to_authenticate_from_host_using_kerberos.md | 2 ++
 ...-08-winevent_scheduled_task_created_within_public_path.md | 2 ++
 docs/_posts/2021-04-12-excel_spawning_powershell.md          | 2 ++
 docs/_posts/2021-04-12-excel_spawning_windows_script_host.md | 2 ++
 ...1-04-12-winevent_scheduled_task_created_to_spawn_shell.md | 2 ++
 docs/_posts/2021-04-12-winword_spawning_powershell.md        | 2 ++
 .../2021-04-12-winword_spawning_windows_script_host.md       | 2 ++
 docs/_posts/2021-04-13-aws_excessive_security_scanning.md    | 2 ++
 ..._attempting_to_authenticate_using_explicit_credentials.md | 2 ++
 ...ple_users_failing_to_authenticate_from_host_using_ntlm.md | 2 ++
 ...13-multiple_users_failing_to_authenticate_from_process.md | 2 ++
 ...tiple_users_remotely_failing_to_authenticate_from_host.md | 2 ++
 .../2021-04-13-office_application_spawn_rundll32_process.md  | 2 ++
 ...users_failing_to_authenticate_from_host_using_kerberos.md | 2 ++
 ...users_failing_to_authenticate_from_host_using_kerberos.md | 2 ++
 .../2021-04-14-office_document_creating_schedule_task.md     | 2 ++
 .../2021-04-14-office_document_executing_macro_code.md       | 2 ++
 .../_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md | 2 ++
 ...lid_users_failing_to_authenticate_from_host_using_ntlm.md | 2 ++
 ...9-gpupdate_with_no_command_line_arguments_with_network.md | 2 ++
 ...4-19-powershell_remote_thread_to_known_windows_process.md | 2 ++
 .../2021-04-19-schedule_task_with_http_command_arguments.md  | 2 ++
 ...2021-04-19-schedule_task_with_rundll32_command_trigger.md | 2 ++
 ...-19-wermgr_process_connecting_to_ip_check_web_services.md | 2 ++
 .../2021-04-19-wermgr_process_create_executable_file.md      | 2 ++
 ...04-19-wermgr_process_spawned_cmd_or_powershell_process.md | 2 ++
 docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md    | 2 ++
 .../2021-04-21-multiple_archive_files_http_post_traffic.md   | 2 ++
 docs/_posts/2021-04-22-anomalous_usage_of_7zip.md            | 2 ++
 ...021-04-22-office_product_spawning_rundll32_with_no_dll.md | 2 ++
 docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md   | 2 ++
 docs/_posts/2021-04-22-winword_spawning_cmd.md               | 2 ++
 docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md  | 2 ++
 docs/_posts/2021-04-26-office_product_spawning_certutil.md   | 2 ++
 docs/_posts/2021-04-26-office_product_spawning_mshta.md      | 2 ++
 docs/_posts/2021-04-26-trickbot_named_pipe.md                | 2 ++
 docs/_posts/2021-04-29-icacls_deny_command.md                | 2 ++
 docs/_posts/2021-04-29-suspicious_driver_loaded_path.md      | 2 ++
 docs/_posts/2021-04-29-xmrig_driver_loaded.md                | 2 ++
 docs/_posts/2021-05-04-deleting_of_net_users.md              | 2 ++
 docs/_posts/2021-05-04-disabling_net_user_account.md         | 2 ++
 .../2021-05-04-excessive_attempt_to_disable_services.md      | 2 ++
 docs/_posts/2021-05-04-excessive_service_stop_attempt.md     | 2 ++
 docs/_posts/2021-05-04-excessive_usage_of_taskkill.md        | 2 ++
 docs/_posts/2021-05-04-icacls_grant_command.md               | 2 ++
 .../2021-05-04-modify_acl_permission_to_files_or_folder.md   | 2 ++
 docs/_posts/2021-05-04-process_kill_base_on_file_path.md     | 2 ++
 docs/_posts/2021-05-05-suspicious_process_file_path.md       | 2 ++
 docs/_posts/2021-05-06-download_files_using_telegram.md      | 2 ++
 .../2021-05-06-enumerate_users_local_group_using_telegram.md | 2 ++
 docs/_posts/2021-05-06-excessive_usage_of_net_app.md         | 2 ++
 ...5-06-executables_or_script_creation_in_suspicious_path.md | 2 ++
 docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md       | 2 ++
 docs/_posts/2021-05-07-schtasks_run_task_on_demand.md        | 2 ++
 docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md  | 2 ++
 docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md       | 2 ++
 docs/_posts/2021-05-13-slui_runas_elevated.md                | 2 ++
 docs/_posts/2021-05-13-slui_spawning_a_process.md            | 2 ++
 docs/_posts/2021-05-18-services_escalate_exe.md              | 2 ++
 .../2021-05-19-allow_inbound_traffic_in_firewall_rule.md     | 2 ++
 docs/_posts/2021-05-19-mailsniper_invoke_functions.md        | 2 ++
 docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md         | 2 ++
 docs/_posts/2021-05-21-winrm_spawning_a_process.md           | 2 ++
 .../2021-05-26-secretdumps_offline_ntds_dumping_tool.md      | 2 ++
 .../2021-05-27-detect_sharphound_file_modifications.md       | 2 ++
 docs/_posts/2021-05-27-detect_sharphound_usage.md            | 2 ++
 .../2021-06-01-detect_azurehound_command-line_arguments.md   | 2 ++
 .../2021-06-01-detect_azurehound_file_modifications.md       | 2 ++
 .../2021-06-01-detect_sharphound_command-line_arguments.md   | 2 ++
 docs/_posts/2021-06-02-conti_common_exec_parameter.md        | 2 ++
 docs/_posts/2021-06-02-modification_of_wallpaper.md          | 2 ++
 docs/_posts/2021-06-02-revil_common_exec_parameter.md        | 2 ++
 docs/_posts/2021-06-02-wbemprox_com_object_execution.md      | 2 ++
 ...r_of_distinct_processes_created_in_windows_temp_folder.md | 2 ++
 .../_posts/2021-06-04-known_services_killed_by_ransomware.md | 2 ++
 .../2021-06-07-excessive_number_of_taskhost_processes.md     | 2 ++
 ...wershell_fileless_process_injection_via_getprocaddress.md | 2 ++
 ...rshell_fileless_script_contains_base64_encoded_content.md | 2 ++
 ...-09-detect_empire_with_powershell_script_block_logging.md | 2 ++
 ...9-detect_mimikatz_with_powershell_script_block_logging.md | 2 ++
 docs/_posts/2021-06-09-unloading_amsi_via_reflection.md      | 2 ++
 .../2021-06-10-clear_unallocated_sector_using_cipher_app.md  | 2 ++
 docs/_posts/2021-06-10-disable_logs_using_wevtutil.md        | 2 ++
 .../2021-06-10-permission_modification_using_takeown_app.md  | 2 ++
 docs/_posts/2021-06-10-powershell_creating_thread_mutex.md   | 2 ++
 docs/_posts/2021-06-10-powershell_domain_enumeration.md      | 2 ++
 ...ding_dotnet_into_memory_via_system_reflection_assembly.md | 2 ++
 .../2021-06-10-powershell_processing_stream_of_data.md       | 2 ++
 .../2021-06-10-powershell_using_memory_as_backing_store.md   | 2 ++
 ...2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md | 2 ++
 docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md | 2 ++
 docs/_posts/2021-06-10-recon_using_wmi_class.md              | 2 ++
 .../2021-06-14-wmi_recon_running_process_or_services.md      | 2 ++
 docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md       | 2 ++
 docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md     | 2 ++
 .../2021-06-16-detect_wmi_event_subscription_persistence.md  | 2 ++
 .../2021-06-17-suspicious_event_log_service_behavior.md      | 2 ++
 .../2021-06-22-execute_javascript_with_jscript_com_clsid.md  | 2 ++
 .../2021-06-22-powershell_enable_smb1protocol_feature.md     | 2 ++
 .../2021-06-22-recursive_delete_of_directory_in_batch_cmd.md | 2 ++
 ...2021-06-23-allow_file_and_printing_sharing_in_firewall.md | 2 ++
 .../_posts/2021-06-23-allow_network_discovery_in_firewall.md | 2 ++
 .../2021-06-24-excessive_usage_of_sc_service_utility.md      | 2 ++
 ...-excessive_number_of_service_control_start_as_disabled.md | 2 ++
 .../2021-07-01-print_spooler_adding_a_printer_driver.md      | 2 ++
 .../2021-07-01-print_spooler_failed_to_load_a_plug-in.md     | 2 ++
 docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md          | 2 ++
 docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md  | 2 ++
 docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md  | 2 ++
 docs/_posts/2021-07-01-spoolsv_writing_a_dll.md              | 2 ++
 docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md     | 2 ++
 .../2021-07-05-msmpeng_application_dll_side_loading.md       | 2 ++
 .../2021-07-05-powershell_disable_security_monitoring.md     | 2 ++
 docs/_posts/2021-07-12-net_profiler_uac_bypass.md            | 2 ++
 docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md   | 2 ++
 ...oud_compute_instance_created_by_previously_unseen_user.md | 2 ++
 docs/_posts/2021-07-19-aws_createaccesskey.md                | 2 ++
 docs/_posts/2021-07-19-aws_createloginprofile.md             | 2 ++
 docs/_posts/2021-07-19-aws_updateloginprofile.md             | 2 ++
 docs/_posts/2021-07-19-detect_new_open_s3_buckets.md         | 2 ++
 .../2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md    | 2 ++
 ...2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md | 2 ++
 docs/_posts/2021-07-19-office_product_spawn_cmd_process.md   | 2 ++
 docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md         | 2 ++
 ...21-detect_copy_of_shadowcopy_with_script_block_logging.md | 2 ++
 docs/_posts/2021-07-23-sam_database_file_access_attempt.md   | 2 ++
 .../2021-07-26-rundll32_createremotethread_in_browser.md     | 2 ++
 docs/_posts/2021-07-26-rundll32_dnsquery.md                  | 2 ++
 .../2021-07-26-rundll32_process_creating_exe_dll_files.md    | 2 ++
 docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md | 2 ++
 docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md     | 2 ++
 docs/_posts/2021-07-27-chcp_command_execution.md             | 2 ++
 .../2021-07-27-regsvr32_with_known_silent_switch_cmdline.md  | 2 ++
 .../2021-07-29-rundll32_create_remote_thread_to_a_process.md | 2 ++
 docs/_posts/2021-07-30-drop_icedid_license_dat.md            | 2 ++
 .../2021-07-30-icedid_exfiltrated_archived_file_creation.md  | 2 ++
 .../2021-07-30-office_application_spawn_regsvr32_process.md  | 2 ++
 docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md       | 2 ++
 .../2021-08-04-create_remote_thread_in_shell_application.md  | 2 ++
 docs/_posts/2021-08-09-uninstall_app_using_msiexec.md        | 2 ++
 docs/_posts/2021-08-10-powershell_execute_com_object.md      | 2 ++
 docs/_posts/2021-08-11-fsutil_zeroing_file.md                | 2 ++
 docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md | 2 ++
 .../2021-08-16-gsuite_drive_share_in_external_email.md       | 2 ++
 docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md | 2 ++
 docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md | 2 ++
 .../2021-08-17-aws_ecr_container_scanning_findings_high.md   | 2 ++
 ..._container_scanning_findings_low_informational_unknown.md | 2 ++
 .../2021-08-17-aws_ecr_container_scanning_findings_medium.md | 2 ++
 ...uite_outbound_email_with_attachment_to_external_domain.md | 2 ++
 docs/_posts/2021-08-18-esentutl_sam_copy.md                  | 2 ++
 docs/_posts/2021-08-18-powershell_4104_hunting.md            | 2 ++
 ...-08-19-aws_ecr_container_upload_outside_business_hours.md | 2 ++
 .../2021-08-19-aws_ecr_container_upload_unknown_user.md      | 2 ++
 ...-08-19-gsuite_email_suspicious_subject_with_attachment.md | 2 ++
 ...21-08-19-protocols_passing_authentication_in_cleartext.md | 2 ++
 docs/_posts/2021-08-20-github_commit_changes_in_master.md    | 2 ++
 docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md       | 2 ++
 docs/_posts/2021-08-23-getlocaluser_with_powershell.md       | 2 ++
 .../2021-08-23-getlocaluser_with_powershell_script_block.md  | 2 ++
 .../2021-08-23-getwmiobject_user_account_with_powershell.md  | 2 ++
 ...getwmiobject_user_account_with_powershell_script_block.md | 2 ++
 ...1-08-23-gsuite_email_with_known_abuse_web_service_link.md | 2 ++
 docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md | 2 ++
 docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md       | 2 ++
 docs/_posts/2021-08-24-adsisearcher_account_discovery.md     | 2 ++
 .../2021-08-24-domain_account_discovery_with_dsquery.md      | 2 ++
 .../2021-08-24-domain_account_discovery_with_net_app.md      | 2 ++
 docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md | 2 ++
 docs/_posts/2021-08-24-get-domaintrust_with_powershell.md    | 2 ++
 ...021-08-24-get-domaintrust_with_powershell_script_block.md | 2 ++
 docs/_posts/2021-08-24-get_aduser_with_powershell.md         | 2 ++
 .../2021-08-24-get_aduser_with_powershell_script_block.md    | 2 ++
 docs/_posts/2021-08-24-get_domainuser_with_powershell.md     | 2 ++
 ...2021-08-24-get_domainuser_with_powershell_script_block.md | 2 ++
 .../2021-08-24-getwmiobject_ds_user_with_powershell.md       | 2 ++
 ...8-24-getwmiobject_ds_user_with_powershell_script_block.md | 2 ++
 docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md   | 2 ++
 .../2021-08-25-domain_group_discovery_with_adsisearcher.md   | 2 ++
 docs/_posts/2021-08-25-domain_group_discovery_with_net.md    | 2 ++
 docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md   | 2 ++
 docs/_posts/2021-08-25-elevated_group_discovery_with_net.md  | 2 ++
 .../2021-08-25-elevated_group_discovery_with_powerview.md    | 2 ++
 docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md | 2 ++
 docs/_posts/2021-08-25-getadgroup_with_powershell.md         | 2 ++
 .../2021-08-25-getadgroup_with_powershell_script_block.md    | 2 ++
 docs/_posts/2021-08-25-getdomaingroup_with_powershell.md     | 2 ++
 .../_posts/2021-08-25-getnettcpconnection_with_powershell.md | 2 ++
 .../2021-08-25-getwmiobject_ds_group_with_powershell.md      | 2 ++
 ...-25-getwmiobject_ds_group_with_powershell_script_block.md | 2 ++
 ...8-26-get_addefaultdomainpasswordpolicy_with_powershell.md | 2 ++
 ...faultdomainpasswordpolicy_with_powershell_script_block.md | 2 ++
 ...8-26-get_aduserresultantpasswordpolicy_with_powershell.md | 2 ++
 ...erresultantpasswordpolicy_with_powershell_script_block.md | 2 ++
 docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md   | 2 ++
 ...21-08-26-get_domainpolicy_with_powershell_script_block.md | 2 ++
 ...2021-08-26-getdomaingroup_with_powershell_script_block.md | 2 ++
 docs/_posts/2021-08-26-password_policy_discovery_with_net.md | 2 ++
 ...08-26-process_creating_lnk_file_in_suspicious_location.md | 2 ++
 docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md | 2 ++
 docs/_posts/2021-08-27-exchange_powershell_module_usage.md   | 2 ++
 .../2021-08-30-domain_controller_discovery_with_nltest.md    | 2 ++
 docs/_posts/2021-08-30-remote_system_discovery_with_net.md   | 2 ++
 .../2021-08-31-petitpotam_network_share_access_request.md    | 2 ++
 .../2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md | 2 ++
 .../2021-08-31-remote_system_discovery_with_dsquery.md       | 2 ++
 docs/_posts/2021-09-01-circle_ci_disable_security_step.md    | 2 ++
 .../2021-09-01-domain_controller_discovery_with_wmic.md      | 2 ++
 .../_posts/2021-09-01-domain_group_discovery_with_dsquery.md | 2 ++
 .../2021-09-01-getadcomputer_with_powershell_script_block.md | 2 ++
 ...-getwmiobject_ds_computer_with_powershell_script_block.md | 2 ++
 docs/_posts/2021-09-01-github_commit_in_develop.md           | 2 ++
 docs/_posts/2021-09-01-github_dependabot_alert.md            | 2 ++
 .../2021-09-01-github_pull_request_from_unknown_user.md      | 2 ++
 .../2021-09-01-remote_system_discovery_with_adsisearcher.md  | 2 ++
 docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md  | 2 ++
 docs/_posts/2021-09-02-circle_ci_disable_security_job.md     | 2 ++
 docs/_posts/2021-09-02-get-foresttrust_with_powershell.md    | 2 ++
 ...021-09-02-get-foresttrust_with_powershell_script_block.md | 2 ++
 ...1-09-02-getdomaincomputer_with_powershell_script_block.md | 2 ++
 ...09-02-getdomaincontroller_with_powershell_script_block.md | 2 ++
 .../2021-09-06-bcdedit_command_back_to_normal_mode_boot.md   | 2 ++
 .../2021-09-06-change_to_safe_mode_with_network_config.md    | 2 ++
 docs/_posts/2021-09-06-correlation_by_repository_and_risk.md | 2 ++
 docs/_posts/2021-09-06-correlation_by_user_and_risk.md       | 2 ++
 docs/_posts/2021-09-07-getadcomputer_with_powershell.md      | 2 ++
 docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md  | 2 ++
 .../_posts/2021-09-07-getdomaincontroller_with_powershell.md | 2 ++
 .../2021-09-07-getwmiobject_ds_computer_with_powershell.md   | 2 ++
 ...-schcache_change_by_app_connect_and_create_adsi_object.md | 2 ++
 .../2021-09-07-system_information_discovery_detection.md     | 2 ++
 ...21-09-08-control_loading_from_world_writable_directory.md | 2 ++
 .../2021-09-08-create_local_admin_accounts_using_net_exe.md  | 2 ++
 docs/_posts/2021-09-08-office_spawning_control.md            | 2 ++
 docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md       | 2 ++
 ...09-08-rundll32_control_rundll_world_writable_directory.md | 2 ++
 docs/_posts/2021-09-09-extraction_of_registry_hives.md       | 2 ++
 .../2021-09-09-mshtml_module_load_in_office_product.md       | 2 ++
 ...09-10-getnettcpconnection_with_powershell_script_block.md | 2 ++
 .../2021-09-10-network_connection_discovery_with_arp.md      | 2 ++
 .../2021-09-10-network_connection_discovery_with_net.md      | 2 ++
 .../2021-09-10-network_connection_discovery_with_netstat.md  | 2 ++
 docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md  | 2 ++
 docs/_posts/2021-09-13-getcurrent_user_with_powershell.md    | 2 ++
 ...021-09-13-getcurrent_user_with_powershell_script_block.md | 2 ++
 .../_posts/2021-09-13-jscript_execution_using_cscript_app.md | 2 ++
 .../2021-09-13-ms_scripting_process_loading_ldap_module.md   | 2 ++
 .../2021-09-13-ms_scripting_process_loading_wmi_module.md    | 2 ++
 docs/_posts/2021-09-13-office_application_drop_executable.md | 2 ++
 docs/_posts/2021-09-13-system_user_discovery_with_query.md   | 2 ++
 docs/_posts/2021-09-13-system_user_discovery_with_whoami.md  | 2 ++
 .../2021-09-13-user_discovery_with_env_vars_powershell.md    | 2 ++
 ...3-user_discovery_with_env_vars_powershell_script_block.md | 2 ++
 docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md     | 2 ++
 .../2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md     | 2 ++
 docs/_posts/2021-09-14-get_wmiobject_group_discovery.md      | 2 ++
 ...et_wmiobject_group_discovery_with_script_block_logging.md | 2 ++
 docs/_posts/2021-09-14-net_localgroup_discovery.md           | 2 ++
 .../_posts/2021-09-14-powershell_get_localgroup_discovery.md | 2 ++
 ...ell_get_localgroup_discovery_with_script_block_logging.md | 2 ++
 docs/_posts/2021-09-14-wmic_group_discovery.md               | 2 ++
 docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md    | 2 ++
 ...-09-15-non_chrome_process_accessing_chrome_default_dir.md | 2 ++
 ...1-09-15-non_firefox_process_access_firefox_profile_dir.md | 2 ++
 docs/_posts/2021-09-16-account_discovery_with_net_app.md     | 2 ++
 ...21-09-16-attempt_to_add_certificate_to_untrusted_store.md | 2 ++
 ...16-attempted_credential_dump_from_registry_via_reg_exe.md | 2 ++
 docs/_posts/2021-09-16-batch_file_write_to_system32.md       | 2 ++
 docs/_posts/2021-09-16-bits_job_persistence.md               | 2 ++
 docs/_posts/2021-09-16-bitsadmin_download_file.md            | 2 ++
 ...09-16-creation_of_shadow_copy_with_wmic_and_powershell.md | 2 ++
 ...6-credential_dumping_via_copy_command_from_shadow_copy.md | 2 ++
 ...21-09-16-credential_dumping_via_symlink_to_shadow_copy.md | 2 ++
 docs/_posts/2021-09-16-detect_html_help_renamed.md           | 2 ++
 .../2021-09-16-detect_html_help_url_in_command_line.md       | 2 ++
 ...09-16-detect_html_help_using_infotech_storage_handlers.md | 2 ++
 docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md  | 2 ++
 docs/_posts/2021-09-16-detect_mshta_renamed.md               | 2 ++
 docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md   | 2 ++
 docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md | 2 ++
 docs/_posts/2021-09-16-detect_renamed_7-zip.md               | 2 ++
 docs/_posts/2021-09-16-detect_renamed_psexec.md              | 2 ++
 docs/_posts/2021-09-16-detect_renamed_rclone.md              | 2 ++
 docs/_posts/2021-09-16-detect_renamed_winrar.md              | 2 ++
 docs/_posts/2021-09-16-dump_lsass_via_procdump.md            | 2 ++
 docs/_posts/2021-09-16-local_account_discovery_with_net.md   | 2 ++
 docs/_posts/2021-09-16-local_account_discovery_with_wmic.md  | 2 ++
 docs/_posts/2021-09-16-office_product_spawning_wmic.md       | 2 ++
 docs/_posts/2021-09-16-processes_launching_netsh.md          | 2 ++
 ...021-09-20-detect_regasm_with_no_command_line_arguments.md | 2 ++
 ...21-09-20-detect_regsvcs_with_no_command_line_arguments.md | 2 ++
 ...9-20-office_document_spawned_child_process_to_download.md | 2 ++
 ...021-09-20-suspicious_dllhost_no_command_line_arguments.md | 2 ++
 ...21-09-20-suspicious_gpupdate_no_command_line_arguments.md | 2 ++
 ...21-09-20-suspicious_microsoft_workflow_compiler_rename.md | 2 ++
 ...21-09-20-suspicious_rundll32_no_command_line_arguments.md | 2 ++
 ...uspicious_searchprotocolhost_no_command_line_arguments.md | 2 ++
 .../2021-09-21-remcos_rat_file_creation_in_remcos_folder.md  | 2 ++
 ...2021-09-21-suspicious_image_creation_in_appdata_folder.md | 2 ++
 .../2021-09-21-suspicious_wav_file_in_appdata_folder.md      | 2 ++
 docs/_posts/2021-09-27-change_default_file_association.md    | 2 ++
 .../2021-09-27-logon_script_event_trigger_execution.md       | 2 ++
 .../_posts/2021-09-27-screensaver_event_trigger_execution.md | 2 ++
 docs/_posts/2021-09-28-print_processor_registry_autostart.md | 2 ++
 docs/_posts/2021-09-29-verclsid_clsid_execution.md           | 2 ++
 .../2021-10-01-vbscript_execution_using_wscript_app.md       | 2 ++
 ...021-10-04-msbuild_suspicious_spawned_by_script_process.md | 2 ++
 ...21-10-04-regsvr32_silent_and_install_param_dll_loading.md | 2 ++
 docs/_posts/2021-10-05-detect_exchange_web_shell.md          | 2 ++
 .../2021-10-05-malicious_inprocserver32_modification.md      | 2 ++
 docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md    | 2 ++
 docs/_posts/2021-10-05-rundll32_shimcache_flush.md           | 2 ++
 docs/_posts/2021-10-05-suspicious_copy_on_system32.md        | 2 ++
 docs/_posts/2021-10-05-winhlp32_spawning_a_process.md        | 2 ++
 ...21-10-06-dns_query_length_with_high_standard_deviation.md | 2 ++
 docs/_posts/2021-10-06-sdelete_application_execution.md      | 2 ++
 ...2021-10-06-wscript_or_cscript_suspicious_child_process.md | 2 ++
 docs/_posts/2021-10-11-suspicious_wevtutil_usage.md          | 2 ++
 ...13-dllhost_with_no_command_line_arguments_with_network.md | 2 ++
 ...3-rundll32_with_no_command_line_arguments_with_network.md | 2 ++
 ...3-searchprotocolhost_with_no_command_line_with_network.md | 2 ++
 ...-10-14-serviceprincipalnames_discovery_with_powershell.md | 2 ++
 ...2021-10-14-serviceprincipalnames_discovery_with_setspn.md | 2 ++
 docs/_posts/2021-10-18-disable_schedule_task.md              | 2 ++
 .../2021-10-19-windows_curl_download_to_suspicious_path.md   | 2 ++
 ...9-winevent_windows_task_scheduler_event_action_started.md | 2 ++
 .../2021-10-20-wmic_noninteractive_app_uninstallation.md     | 2 ++
 docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md     | 2 ++
 docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md  | 2 ++
 docs/_posts/2021-11-03-windows_adfind_exe.md                 | 2 ++
 docs/_posts/2021-11-04-attacker_tools_on_endpoint.md         | 2 ++
 ...e_token_or_hash_observed_by_an_event_collecting_device.md | 2 ++
 .../2021-11-10-windows_curl_upload_to_remote_destination.md  | 2 ++
 ...2021-11-10-windows_service_creation_on_remote_endpoint.md | 2 ++
 ...21-11-10-windows_service_initiation_on_remote_endpoint.md | 2 ++
 ...11-11-remote_process_instantiation_via_winrm_and_winrs.md | 2 ++
 ...11-scheduled_task_creation_on_remote_endpoint_using_at.md | 2 ++
 ...021-11-11-scheduled_task_initiation_on_remote_endpoint.md | 2 ++
 .../2021-11-11-schtasks_scheduling_job_on_remote_system.md   | 2 ++
 docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md         | 2 ++
 .../2021-11-12-aws_iam_accessdenied_discovery_events.md      | 2 ++
 docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md     | 2 ++
 docs/_posts/2021-11-12-firewall_allowed_program_enable.md    | 2 ++
 .../2021-11-12-network_discovery_using_route_windows_app.md  | 2 ++
 .../2021-11-12-remote_process_instantiation_via_wmi.md       | 2 ++
 docs/_posts/2021-11-12-runas_execution_in_commandline.md     | 2 ++
 .../2021-11-12-windows_installutil_credential_theft.md       | 2 ++
 ...21-11-12-windows_installutil_remote_network_connection.md | 2 ++
 .../2021-11-12-windows_installutil_uninstall_option.md       | 2 ++
 ...1-12-windows_installutil_uninstall_option_with_network.md | 2 ++
 .../2021-11-12-windows_installutil_url_in_command_line.md    | 2 ++
 ...5-remote_process_instantiation_via_dcom_and_powershell.md | 2 ++
 ...ess_instantiation_via_dcom_and_powershell_script_block.md | 2 ++
 ...15-remote_process_instantiation_via_wmi_and_powershell.md | 2 ++
 ...cess_instantiation_via_wmi_and_powershell_script_block.md | 2 ++
 docs/_posts/2021-11-15-sdelete_application_execution.md      | 2 ++
 docs/_posts/2021-11-15-windows_diskcryptor_usage.md          | 2 ++
 ...21-11-16-high_frequency_copy_of_files_in_network_share.md | 2 ++
 ...-remote_process_instantiation_via_winrm_and_powershell.md | 2 ++
 ...ss_instantiation_via_winrm_and_powershell_script_block.md | 2 ++
 docs/_posts/2021-11-17-windows_dism_remove_defender.md       | 2 ++
 ...18-executable_file_written_in_administrative_smb_share.md | 2 ++
 ...interactive_session_on_remote_endpoint_with_powershell.md | 2 ++
 docs/_posts/2021-11-18-loading_of_dynwrapx_module.md         | 2 ++
 ...1-11-19-system_info_gathering_using_dxdiag_application.md | 2 ++
 docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md   | 2 ++
 .../2021-11-22-possible_browser_pass_view_parameter.md       | 2 ++
 .../2021-11-22-services_lolbas_execution_process_spawn.md    | 2 ++
 .../2021-11-22-svchost_lolbas_execution_process_spawn.md     | 2 ++
 ...2-windows_service_created_with_suspicious_service_path.md | 2 ++
 .../2021-11-22-windows_service_created_within_public_path.md | 2 ++
 .../2021-11-22-wmiprsve_lolbas_execution_process_spawn.md    | 2 ++
 .../2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md | 2 ++
 docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md | 2 ++
 docs/_posts/2021-11-24-attempt_to_delete_services.md         | 2 ++
 docs/_posts/2021-11-24-attempt_to_disable_services.md        | 2 ++
 .../2021-11-25-add_or_set_windows_defender_exclusion.md      | 2 ++
 ...1-11-25-powershell_windows_defender_exclusion_commands.md | 2 ++
 .../2021-11-25-windows_defender_exclusion_registry_entry.md  | 2 ++
 ...29-attempted_credential_dump_from_registry_via_reg_exe.md | 2 ++
 .../_posts/2021-11-29-deny_permission_using_cacls_utility.md | 2 ++
 .../2021-11-29-detect_dump_lsass_memory_using_comsvcs.md     | 2 ++
 docs/_posts/2021-11-29-detect_rclone_command-line_usage.md   | 2 ++
 .../2021-11-29-possible_lateral_movement_powershell_spawn.md | 2 ++
 .../2021-11-29-randomly_generated_scheduled_task_name.md     | 2 ++
 .../2021-11-29-randomly_generated_windows_service_name.md    | 2 ++
 docs/_posts/2021-11-30-delete_a_net_user.md                  | 2 ++
 docs/_posts/2021-11-30-disable_net_user_account.md           | 2 ++
 .../2021-11-30-first_time_seen_command_line_argument.md      | 2 ++
 .../2021-11-30-grant_permission_using_cacls_utility.md       | 2 ++
 .../2021-11-30-modify_acls_permission_of_files_or_folders.md | 2 ++
 ...s_the_token_or_hash_observed_at_the_destination_device.md | 2 ++
 .../2021-11-30-rare_parent-child_process_relationship.md     | 2 ++
 docs/_posts/2021-11-30-resize_shadowstorage_volume.md        | 2 ++
 ...1-unusual_number_of_computer_service_tickets_requested.md | 2 ++
 ...nusual_number_of_remote_endpoint_authentication_events.md | 2 ++
 docs/_posts/2021-12-03-detect_rclone_command-line_usage.md   | 2 ++
 docs/_posts/2021-12-03-short_lived_scheduled_task.md         | 2 ++
 .../2021-12-03-windows_curl_upload_to_remote_destination.md  | 2 ++
 .../2021-12-07-anomalous_usage_of_account_credentials.md     | 2 ++
 .../2021-12-07-bcdedit_failure_recovery_modification.md      | 2 ++
 .../_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md | 2 ++
 .../2021-12-07-excessive_number_of_office_files_copied.md    | 2 ++
 docs/_posts/2021-12-07-fsutil_zeroing_file.md                | 2 ++
 docs/_posts/2021-12-07-high_file_deletion_frequency.md       | 2 ++
 ...ailbox_replication_service_writing_active_server_pages.md | 2 ++
 docs/_posts/2021-12-07-wbadmin_delete_system_backups.md      | 2 ++
 .../2021-12-07-windows_raccine_scheduled_task_deletion.md    | 2 ++
 .../_posts/2021-12-08-disable_defender_antivirus_registry.md | 2 ++
 .../2021-12-08-msi_module_loaded_by_non-system_binary.md     | 2 ++
 docs/_posts/2021-12-10-curl_download_and_bash_execution.md   | 2 ++
 docs/_posts/2021-12-11-wget_download_and_bash_execution.md   | 2 ++
 docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md       | 2 ++
 ...2021-12-13-java_class_file_download_by_java_user_agent.md | 2 ++
 docs/_posts/2021-12-13-linux_java_spawning_shell.md          | 2 ++
 .../2021-12-13-log4shell_jndi_payload_injection_attempt.md   | 2 ++
 ...4shell_jndi_payload_injection_with_outbound_connection.md | 2 ++
 ...bound_network_connection_from_java_using_default_ports.md | 2 ++
 docs/_posts/2021-12-13-windows_java_spawning_shells.md       | 2 ++
 docs/_posts/2021-12-14-hunting_for_log4shell.md              | 2 ++
 ...021-12-17-linux_add_files_in_known_crontab_directories.md | 2 ++
 .../_posts/2021-12-17-linux_at_allow_config_file_creation.md | 2 ++
 docs/_posts/2021-12-17-linux_at_application_execution.md     | 2 ++
 docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md    | 2 ++
 ...-linux_possible_append_command_to_at_allow_config_file.md | 2 ++
 ...possible_append_cronjob_entry_on_existing_cronjob_file.md | 2 ++
 ...-12-17-linux_possible_cronjob_modification_with_editor.md | 2 ++
 .../2021-12-20-clear_unallocated_sector_using_cipher_app.md  | 2 ++
 ...021-12-20-hiding_files_and_directories_with_attrib_exe.md | 2 ++
 .../2021-12-20-linux_file_creation_in_init_boot_directory.md | 2 ++
 .../2021-12-20-linux_file_creation_in_profile_directory.md   | 2 ++
 ...0-linux_possible_append_command_to_profile_config_file.md | 2 ++
 ...-12-20-linux_service_file_created_in_systemd_directory.md | 2 ++
 docs/_posts/2021-12-20-linux_service_restarted.md            | 2 ++
 docs/_posts/2021-12-20-linux_service_started_or_enabled.md   | 2 ++
 .../2021-12-20-suspicious_computer_account_name_change.md    | 2 ++
 .../2021-12-20-suspicious_kerberos_service_ticket_request.md | 2 ++
 docs/_posts/2021-12-21-linux_add_user_account.md             | 2 ++
 docs/_posts/2021-12-21-linux_change_file_owner_to_root.md    | 2 ++
 .../2021-12-21-linux_nopasswd_entry_in_sudoers_file.md       | 2 ++
 docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md   | 2 ++
 docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md  | 2 ++
 docs/_posts/2021-12-21-linux_visudo_utility_execution.md     | 2 ++
 .../2021-12-21-suspicious_ticket_granting_ticket_request.md  | 2 ++
 ...21-12-22-linux_file_created_in_kernel_driver_directory.md | 2 ++
 ...-12-22-linux_insert_kernel_module_using_insmod_utility.md | 2 ++
 ...-22-linux_install_kernel_module_using_modprobe_utility.md | 2 ++
 docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md | 2 ++
 .../2021-12-23-linux_common_process_for_elevation_control.md | 2 ++
 docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md    | 2 ++
 docs/_posts/2022-01-04-linux_sudo_or_su_execution.md         | 2 ++
 docs/_posts/2022-01-05-linux_doas_conf_file_creation.md      | 2 ++
 docs/_posts/2022-01-05-linux_doas_tool_execution.md          | 2 ++
 .../2022-01-10-linux_possible_access_to_credential_files.md  | 2 ++
 .../2022-01-10-linux_possible_access_to_sudoers_file.md      | 2 ++
 ...ux_possible_access_or_modification_of_sshd_config_file.md | 2 ++
 .../2022-01-11-linux_possible_ssh_key_file_creation.md       | 2 ++
 ...12-powershell_-_connect_to_internet_with_hidden_window.md | 2 ++
 ...2-01-12-windows_hunting_system_account_targeting_lsass.md | 2 ++
 .../2022-01-12-windows_non-system_account_targeting_lsass.md | 2 ++
 .../2022-01-14-potentially_malicious_code_on_commandline.md  | 2 ++
 .../2022-01-18-cmd_carry_out_string_command_parameter.md     | 2 ++
 ...01-18-impacket_lateral_movement_commandline_parameters.md | 2 ++
 ...2-01-18-malicious_powershell_process_-_encoded_command.md | 2 ++
 ...-suspicious_process_dns_query_known_abuse_web_services.md | 2 ++
 .../2022-01-19-suspicious_process_with_discord_dns_query.md  | 2 ++
 .../2022-01-19-windows_dotnet_binary_in_non_standard_path.md | 2 ++
 .../2022-01-19-windows_installutil_in_non_standard_path.md   | 2 ++
 ...22-01-20-excessive_file_deletion_in_windefender_folder.md | 2 ++
 docs/_posts/2022-01-20-ping_sleep_batch_command.md           | 2 ++
 ...022-01-20-powershell_remove_windows_defender_directory.md | 2 ++
 docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md        | 2 ++
 docs/_posts/2022-01-24-windows_nirsoft_utilities.md          | 2 ++
 docs/_posts/2022-01-26-active_setup_registry_autostart.md    | 2 ++
 .../2022-01-26-add_defaultuser_and_password_in_registry.md   | 2 ++
 ...-01-26-allow_inbound_traffic_by_firewall_rule_registry.md | 2 ++
 docs/_posts/2022-01-26-allow_operation_with_consent_admin.md | 2 ++
 docs/_posts/2022-01-26-disable_amsi_through_registry.md      | 2 ++
 .../_posts/2022-01-26-disable_defender_antivirus_registry.md | 2 ++
 .../2022-01-26-disable_defender_blockatfirstseen_feature.md  | 2 ++
 .../2022-01-26-disable_defender_enhanced_notification.md     | 2 ++
 docs/_posts/2022-01-26-disable_defender_mpengine_registry.md | 2 ++
 docs/_posts/2022-01-26-disable_defender_spynet_reporting.md  | 2 ++
 ...-01-26-disable_defender_submit_samples_consent_feature.md | 2 ++
 docs/_posts/2022-01-26-registry_keys_used_for_persistence.md | 2 ++
 ...2022-01-26-registry_keys_used_for_privilege_escalation.md | 2 ++
 .../2022-01-26-remcos_client_registry_install_entry.md       | 2 ++
 docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md     | 2 ++
 docs/_posts/2022-01-26-time_provider_persistence_registry.md | 2 ++
 docs/_posts/2022-01-27-disable_etw_through_registry.md       | 2 ++
 docs/_posts/2022-01-27-disable_registry_tool.md              | 2 ++
 ...2022-01-27-disable_security_logs_using_minint_registry.md | 2 ++
 docs/_posts/2022-01-27-disable_show_hidden_files.md          | 2 ++
 docs/_posts/2022-01-27-disable_uac_remote_restriction.md     | 2 ++
 docs/_posts/2022-01-27-disable_windows_app_hotkeys.md        | 2 ++
 .../_posts/2022-01-27-disable_windows_behavior_monitoring.md | 2 ++
 .../2022-01-27-disable_windows_smartscreen_protection.md     | 2 ++
 docs/_posts/2022-01-27-disabling_cmd_application.md          | 2 ++
 docs/_posts/2022-01-27-disabling_controlpanel.md             | 2 ++
 .../_posts/2022-01-27-windows_possible_credential_dumping.md | 2 ++
 docs/_posts/2022-01-28-disabling_defender_services.md        | 2 ++
 .../2022-01-28-disabling_folderoptions_windows_feature.md    | 2 ++
 docs/_posts/2022-01-28-disabling_norun_windows_app.md        | 2 ++
 .../_posts/2022-01-28-disabling_systemrestore_in_registry.md | 2 ++
 docs/_posts/2022-01-28-disabling_task_manager.md             | 2 ++
 docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md    | 2 ++
 .../2022-01-28-enable_wdigest_uselogoncredential_registry.md | 2 ++
 docs/_posts/2022-01-28-etw_registry_disabled.md              | 2 ++
 docs/_posts/2022-01-28-eventvwr_uac_bypass.md                | 2 ++
 .../2022-01-28-hide_user_account_from_sign-in_screen.md      | 2 ++
 docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md  | 2 ++
 docs/_posts/2022-02-03-o365_added_service_principal.md       | 2 ++
 docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md     | 2 ++
 docs/_posts/2022-02-03-o365_disable_mfa.md                   | 2 ++
 docs/_stories/credential_dumping.md                          | 2 +-
 docs/_stories/windows_defense_evasion_tactics.md             | 2 +-
 docs/_stories/windows_persistence_techniques.md              | 2 +-
 754 files changed, 1507 insertions(+), 9 deletions(-)

diff --git a/bin/doc_gen.py b/bin/doc_gen.py
index 0e5ba698ec..83c71a4cdb 100644
--- a/bin/doc_gen.py
+++ b/bin/doc_gen.py
@@ -345,11 +345,14 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
         additional_detection_lookups = parse_and_add_lookups(detection_yaml['search'], lookups)
         if len(additional_detection_lookups) > 0:
             for lookup in additional_detection_lookups:
+                # skip duplicate lookups
+                if lookup in detection_lookups:
+                    continue
                 detection_lookups.append(lookup)
             detection_yaml['lookups'] = detection_lookups
         detection_yaml['lookups'] = detection_lookups
         
-          # sort macros and lookups
+        # sort macros and lookups
         sorted_macros = sorted(detection_yaml['macros'], key=lambda i: i['name'])
         detection_yaml['macros'] = sorted_macros
         sorted_lookups = sorted(detection_yaml['lookups'], key=lambda i: i['name'])
diff --git a/bin/jinja2_templates/doc_detections.j2 b/bin/jinja2_templates/doc_detections.j2
index 0d6f20535d..06e358a438 100644
--- a/bin/jinja2_templates/doc_detections.j2
+++ b/bin/jinja2_templates/doc_detections.j2
@@ -119,6 +119,8 @@ The SPL above uses the following Lookups:
 | {{(detection.tags.impact * detection.tags.confidence)/100}} | {{ detection.tags.impact }} | {{ detection.tags.confidence }} | {{detection.tags.message}} |
 {% endif %}
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 {% if detection.cve %}
 #### CVE
 
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index 4886efadc9..cb94713d5c 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -61,8 +61,8 @@ sidebar:
 | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
@@ -357,8 +357,8 @@ sidebar:
 | [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly |
 | [Gsuite suspicious calendar invite](/cloud/gsuite_suspicious_calendar_invite/) | [Phishing](/tags/#phishing) | Hunting |
 | [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | Anomaly |
diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
index a29b070bbd..848b89865f 100644
--- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
+++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
@@ -73,6 +73,8 @@ Legitimate router connections may appear as new connections
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
index 650696bef5..91ad0bfa73 100644
--- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
+++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
@@ -76,6 +76,8 @@ This search might be prone to high false positives. Please consider this when co
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
index bb8a83c18d..02bbc6f802 100644
--- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
+++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
@@ -75,6 +75,8 @@ None identified
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
index d6b8c5a242..c286a458fc 100644
--- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
+++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
@@ -79,6 +79,8 @@ None at this time
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
index 57c4a26d94..4cd80b693d 100644
--- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
+++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
@@ -82,6 +82,8 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
index de8511ad97..ac6c61880c 100644
--- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
@@ -82,6 +82,8 @@ It&#39;s possible for legitimate HTTP requests to be made to URLs containing the
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
index 8447ccf664..e47cff84db 100644
--- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
@@ -76,6 +76,8 @@ No known false positives for this detection.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
index 8ba02f7477..e3249233cd 100644
--- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
@@ -76,6 +76,8 @@ None at this time
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md
index 6718992b26..3d88168e32 100644
--- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md
+++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md
@@ -70,6 +70,8 @@ Very few legitimate Content-Type fields will have a length greater than 100 char
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
index 8a28c1e6b1..ebddea9d5a 100644
--- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
+++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
@@ -82,6 +82,8 @@ None at this time
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
index c5aaa5955d..87d7d44189 100644
--- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
+++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
@@ -60,7 +60,6 @@ Note that `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter` is a e
 #### Lookups
 The SPL above uses the following Lookups:
 
-* [baseline_blocked_outbound_connections](https://github.com/splunk/security_content/blob/develop/lookups/baseline_blocked_outbound_connections.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/baseline_blocked_outbound_connections.csv)
 * [baseline_blocked_outbound_connections](https://github.com/splunk/security_content/blob/develop/lookups/baseline_blocked_outbound_connections.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/baseline_blocked_outbound_connections.csv)
 
 #### Required field
@@ -89,6 +88,8 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
index d70a6dff23..41a8a13207 100644
--- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
@@ -85,6 +85,8 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
index 512a5e1674..cb49e6796c 100644
--- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
@@ -87,6 +87,8 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
index b0177d256b..f9970a7d43 100644
--- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
+++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
@@ -87,6 +87,8 @@ After a new image is created, the first systems created with that image will cau
 | 36.0 | 60 | 60 | User $user$ is creating an instance $dest$ with an image that has not been previously seen. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
index 992b0179b8..ae51645314 100644
--- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
@@ -83,6 +83,8 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
index af9d904ab3..f05b2a1938 100644
--- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
@@ -81,6 +81,8 @@ Some software may create WMI temporary event subscriptions for various purposes.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
index 118bb9a794..9f9d2527e6 100644
--- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
+++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
@@ -73,7 +73,6 @@ Note that `detect_spike_in_s3_bucket_deletion_filter` is a empty macro by defaul
 #### Lookups
 The SPL above uses the following Lookups:
 
-* [s3_deletion_baseline](https://github.com/splunk/security_content/blob/develop/lookups/s3_deletion_baseline.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/s3_deletion_baseline.csv)
 * [s3_deletion_baseline](https://github.com/splunk/security_content/blob/develop/lookups/s3_deletion_baseline.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/s3_deletion_baseline.csv)
 
 #### Required field
@@ -98,6 +97,8 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
index 99f1a25afc..cf71ad52d2 100644
--- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
@@ -89,6 +89,8 @@ Administrators may use this legitimately to gather info from remote systems. Fil
 | 36.0 | 60 | 60 | A wmic.exe process $process$ contain node commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md
index d018df239f..a17ff3cde3 100644
--- a/docs/_posts/2018-12-03-usn_journal_deletion.md
+++ b/docs/_posts/2018-12-03-usn_journal_deletion.md
@@ -89,6 +89,8 @@ None identified
 | 45.0 | 50 | 90 | Possible USN journal deletion on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md
index 9f628dca7d..2552d5f088 100644
--- a/docs/_posts/2018-12-06-suspicious_java_classes.md
+++ b/docs/_posts/2018-12-06-suspicious_java_classes.md
@@ -77,6 +77,8 @@ There are no known false positives.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md
index e661f24ff2..2773fd90af 100644
--- a/docs/_posts/2018-12-14-file_with_samsam_extension.md
+++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md
@@ -78,6 +78,8 @@ Because these extensions are not typically used in normal operations, you should
 | 90.0 | 100 | 90 | File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md
index a341cf6aa9..4098507a1d 100644
--- a/docs/_posts/2018-12-14-samsam_test_file_write.md
+++ b/docs/_posts/2018-12-14-samsam_test_file_write.md
@@ -85,6 +85,8 @@ No false positives have been identified.
 | 12.0 | 60 | 20 | A samsam ransomware test file creation in $file_path$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
index 2616237784..f2542e5ca7 100644
--- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
+++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
@@ -72,6 +72,8 @@ There might be some false positives as keyboard event taps are used by processes
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
index 8bf22f477b..080ebe2dda 100644
--- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
@@ -82,6 +82,8 @@ Some of these processes may be used legitimately on web servers during maintenan
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
index c00539a07e..754067fe76 100644
--- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
@@ -80,6 +80,8 @@ Some legitimate applications use long command lines for installs or updates. You
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
index b8752e8916..76c6a4b899 100644
--- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
@@ -93,6 +93,8 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas
 | 80.0 | 80 | 100 | The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
index 2544b67105..a5da0aaa95 100644
--- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
@@ -93,6 +93,8 @@ Other tools can import the same DLLs. These tools should be part of a whitelist.
 | 64.0 | 80 | 80 | A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
index 37dd81d3d9..9720416e8d 100644
--- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
@@ -91,6 +91,8 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
 | 63.0 | 70 | 90 | process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
index 2048c716cc..c81e475186 100644
--- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
@@ -91,6 +91,8 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th
 | 81.0 | 90 | 90 | A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
index 40cc22dc54..cf986ef1a7 100644
--- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md
+++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
@@ -96,6 +96,8 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives.
 | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
index 7b02d1d34c..83bd3fd38d 100644
--- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
@@ -100,6 +100,8 @@ If you are seeing more results than desired, you may consider reducing the value
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
index 507f417639..2f3c482246 100644
--- a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
+++ b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
@@ -93,6 +93,8 @@ unknown
 | 63.0 | 70 | 90 | modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
index 81920e53a7..624903ecfb 100644
--- a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
+++ b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
@@ -97,6 +97,8 @@ You will encounter noise from legitimate print-monitor registry entries.
 | 64.0 | 80 | 80 | New print monitor added on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
index 03cfb71d14..cf0d71a0bc 100644
--- a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
+++ b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
@@ -95,6 +95,8 @@ There are many legitimate applications that leverage shim databases for compatib
 | 56.0 | 70 | 80 | A registry activity in $registry_path$ related to shim modication in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-01-28-sdclt_uac_bypass.md b/docs/_posts/2020-01-28-sdclt_uac_bypass.md
index 0bd5b88d45..9402aa992d 100644
--- a/docs/_posts/2020-01-28-sdclt_uac_bypass.md
+++ b/docs/_posts/2020-01-28-sdclt_uac_bypass.md
@@ -95,6 +95,8 @@ Limited to no false positives are expected.
 | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
index 9d3155d8dd..bee604b8bc 100644
--- a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
+++ b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
@@ -95,6 +95,8 @@ unknown
 | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-01-28-wsreset_uac_bypass.md b/docs/_posts/2020-01-28-wsreset_uac_bypass.md
index bf55049c5e..c6b5cc762a 100644
--- a/docs/_posts/2020-01-28-wsreset_uac_bypass.md
+++ b/docs/_posts/2020-01-28-wsreset_uac_bypass.md
@@ -95,6 +95,8 @@ unknown
 | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
index d049b94220..bc225fe201 100644
--- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
@@ -89,6 +89,8 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
 | 80.0 | 80 | 100 | $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
index 7c75058eb1..0cc6f59d08 100644
--- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
+++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
@@ -74,6 +74,8 @@ At this stage, there are no known false positives. During testing, no process ev
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
index f25313b1db..82801cdac1 100644
--- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
+++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
@@ -71,6 +71,8 @@ Uploading container is a normal behavior from developers or users with access to
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
index 58a3f74610..9a1c8938a9 100644
--- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
@@ -99,6 +99,8 @@ None identified.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
index a6933d540a..0b3d076c32 100644
--- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
+++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
@@ -85,6 +85,8 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md
index 0058f2d863..ef38c3b72f 100644
--- a/docs/_posts/2020-03-16-detect_rare_executables.md
+++ b/docs/_posts/2020-03-16-detect_rare_executables.md
@@ -89,6 +89,8 @@ Some legitimate processes may be only rarely executed in your environment. As th
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md
index d2cd92fb5d..0c34939b1d 100644
--- a/docs/_posts/2020-03-16-process_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md
@@ -86,6 +86,8 @@ Although unlikely, administrators may use wmi to execute commands for legitimate
 | 49.0 | 70 | 70 | A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md
index e402a87aaa..94fcfce857 100644
--- a/docs/_posts/2020-03-16-script_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md
@@ -84,6 +84,8 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p
 | 36.0 | 60 | 60 | A wmic.exe process $process_name$ taht execute script in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md
index a59bbb1860..7d30285671 100644
--- a/docs/_posts/2020-03-16-spike_in_file_writes.md
+++ b/docs/_posts/2020-03-16-spike_in_file_writes.md
@@ -72,6 +72,8 @@ It is important to understand that if you happen to install any new applications
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
index d025fd1699..c0450ba2ee 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
@@ -86,6 +86,8 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
index 17c2446de2..0bfa556de7 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
@@ -87,6 +87,8 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
index 8eecb3d6b6..8328714ed0 100644
--- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
@@ -98,6 +98,8 @@ A new child process of zoom isn&#39;t malicious by that fact alone. Further inve
 | 64.0 | 80 | 80 | Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
index 69ba49d44f..7bb0458e75 100644
--- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
+++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
@@ -88,6 +88,8 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It&#39;s susp
 | 15.0 | 30 | 50 | AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
index 0fce192856..5fdf216414 100644
--- a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
+++ b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
@@ -83,6 +83,8 @@ When a legitimate new user logins for the first time, this activity will be dete
 | 30.0 | 50 | 60 | User $user$ is logging into the AWS console for the first time |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
index 3730b87892..42eaf133ce 100644
--- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
+++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
@@ -70,6 +70,8 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
index 813182bc81..05b514b13f 100644
--- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
+++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
@@ -107,6 +107,8 @@ unknown
 | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
index e5be7ad3b3..cb7a0c7403 100644
--- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md
+++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
@@ -90,6 +90,8 @@ It is possible that an administrator created and deleted an account in a short t
 | 63.0 | 70 | 90 | A user account created or delete shortly in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md
index 57d853aa82..2ad60b568b 100644
--- a/docs/_posts/2020-07-06-windows_event_log_cleared.md
+++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md
@@ -88,6 +88,8 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi
 | 70.0 | 70 | 100 | Windows event logs cleared on $dest$ via EventCode $EventCode$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
index a9c2867f01..f46820f9d4 100644
--- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
+++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
@@ -90,6 +90,8 @@ Remote Desktop may be used legitimately by users on the network.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
index cd752c0445..d3698f594c 100644
--- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md
+++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
@@ -92,6 +92,8 @@ The activity may be legitimate. For this reason, it&#39;s best to verify the acc
 | 42.0 | 60 | 70 | A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
index 644215088e..6602bbd27d 100644
--- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
+++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
@@ -82,6 +82,8 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
index 1700025a46..640772987e 100644
--- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
@@ -107,6 +107,8 @@ None identified. Attempts to disable security-related services should be identif
 | 20.0 | 40 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
index c09fd3030f..339506e5a8 100644
--- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
+++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
@@ -95,6 +95,8 @@ It is possible that a legitimate user is experiencing an issue causing multiple
 | 36.0 | 60 | 60 | Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
index 6daa9cb924..05665d5f90 100644
--- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
+++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
@@ -91,6 +91,8 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate,
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
index 3e2be95791..5875eb63cb 100644
--- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
+++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
@@ -98,6 +98,8 @@ It is not uncommon for outlook to write legitimate zip files to the disk.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
index cf1e0799bb..25b405aee7 100644
--- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
+++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
@@ -92,6 +92,8 @@ Some legitimate applications may exhibit this behavior.
 | 35.0 | 70 | 50 | cmd.exe launching script interpreters on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
index ee97b67dbd..2ef9392175 100644
--- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
+++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
@@ -83,6 +83,8 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
index b63d8cc813..7a644734ff 100644
--- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
+++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
@@ -86,6 +86,8 @@ Administrators and users sometimes prefer backing up their email data by moving
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
index 4c77199c8d..26adafdea7 100644
--- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
+++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
@@ -88,6 +88,8 @@ The false-positive rate will vary based on how you set the deviation_threshold a
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md
index 8c7dbc4d95..f6b6c27dd8 100644
--- a/docs/_posts/2020-07-21-excessive_dns_failures.md
+++ b/docs/_posts/2020-07-21-excessive_dns_failures.md
@@ -89,6 +89,8 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
index 0cfa41e016..2e9cc0e635 100644
--- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
+++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
@@ -92,6 +92,8 @@ A previously unseen service is not necessarily malicious. Verify that the servic
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
index 937eaa4ef4..bc8abe10ed 100644
--- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
+++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
@@ -91,6 +91,8 @@ Some applications and users may legitimately use attrib.exe to interact with the
 | 72.0 | 90 | 80 | Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
index 7a3b372e04..65412214de 100644
--- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
+++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
@@ -87,6 +87,8 @@ The false-positive rate will vary based on how you set the deviation_threshold a
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
index 16d1e18ac8..8807d6c973 100644
--- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
+++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
@@ -99,6 +99,8 @@ There may be legitimate reasons to bypass the PowerShell execution policy. The P
 | 42.0 | 70 | 60 | PowerShell local execution policy bypass attempt on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
index 175776fcce..6fe60a80fb 100644
--- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
+++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
@@ -93,6 +93,8 @@ A single public IP address servicing multiple legitmate users may trigger this s
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md
index bd50c4d8bd..db2367dad0 100644
--- a/docs/_posts/2020-07-21-okta_account_lockout_events.md
+++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md
@@ -86,6 +86,8 @@ None. Account lockouts should be followed up on to determine if the actual user
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
index 42ec91189a..d80fb2a790 100644
--- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
+++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
@@ -89,6 +89,8 @@ There may be a faulty config preventing legitmate users from accessing apps they
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
index 11374bc0b6..e017844871 100644
--- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
+++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
@@ -89,6 +89,8 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
index 4560df7a7d..06c68fd3bd 100644
--- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
+++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
@@ -91,6 +91,8 @@ Microsoft may provide updates to these binaries. Verify that these changes do no
 | 72.0 | 80 | 90 | A suspicious file modification or replace in $file_path$  in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
index a647aff3b4..1a8d02af91 100644
--- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
+++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
@@ -86,6 +86,8 @@ None identified
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
index d942cebac8..ff7a201b66 100644
--- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
+++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
@@ -86,6 +86,8 @@ None identified
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
index 1c63cbe857..b973bd6e19 100644
--- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
+++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
@@ -87,6 +87,8 @@ RDP gateways may have unusually high amounts of traffic from all other hosts&#39
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
index c3185d4581..2f38a78798 100644
--- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
+++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
@@ -86,6 +86,8 @@ Remote Desktop may be used legitimately by users on the network.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
index 8fec1118f7..a763a52d23 100644
--- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
+++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
@@ -97,6 +97,8 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l
 | 56.0 | 70 | 80 | A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md
index 34b695b410..138a0ff6ee 100644
--- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md
+++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md
@@ -83,6 +83,8 @@ It&#39;s possible that legitimate traffic will have long URLs or long user agent
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md
index 3baccd2a57..ce817934d8 100644
--- a/docs/_posts/2020-07-22-smb_traffic_spike.md
+++ b/docs/_posts/2020-07-22-smb_traffic_spike.md
@@ -89,6 +89,8 @@ A file server may experience high-demand loads that could cause this analytic to
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
index 663c2347ee..866e70a22a 100644
--- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
+++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
@@ -95,6 +95,8 @@ If you are seeing more results than desired, you may consider reducing the value
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
index 806848820d..ead71021d1 100644
--- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
@@ -94,6 +94,8 @@ None identified
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
index c3c8055857..443fe3d7b7 100644
--- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
+++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
@@ -98,6 +98,8 @@ It&#39;s possible for system administrators to write scripts that exhibit this b
 | 35.0 | 70 | 50 | Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
index a0f5deef09..61c497c2e7 100644
--- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
+++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
@@ -89,6 +89,8 @@ Because the Recycle Bin is a hidden folder in modern versions of Windows, it wou
 | 28.0 | 40 | 70 | Suspicious writes to windows Recycle Bin process $Processes.process_name$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md
index ff46982a56..46b8a629d9 100644
--- a/docs/_posts/2020-07-22-tor_traffic.md
+++ b/docs/_posts/2020-07-22-tor_traffic.md
@@ -89,6 +89,8 @@ None at this time
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
index 0431142e13..f81ae6c0d0 100644
--- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
+++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
@@ -92,6 +92,8 @@ You must be ingesting data that records process activity from your hosts to popu
 | 45.0 | 50 | 90 | Possible Sysmon filter driver unloading on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
index b3133924c0..f7408a07a5 100644
--- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
+++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
@@ -77,6 +77,8 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
index 7502eaf8c5..a0af3f9bd7 100644
--- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
+++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
@@ -87,6 +87,8 @@ Not all permanent key creations are malicious. If there is a policy of rotating
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md
index f3231b38ce..1b2a99dfb9 100644
--- a/docs/_posts/2020-07-27-aws_detect_role_creation.md
+++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md
@@ -92,6 +92,8 @@ CreateRole is not very common in common users. This search can be adjusted to pr
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
index 93512639cb..1613443534 100644
--- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
+++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
@@ -86,6 +86,8 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
index b23ae8e210..96891cb8e8 100644
--- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
+++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
@@ -85,6 +85,8 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
index 9323d26dfc..a1cd428847 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
@@ -81,6 +81,8 @@ unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
index 63600160c2..5b76d34377 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
@@ -85,6 +85,8 @@ unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
index 8eafba8ea8..be533680fe 100644
--- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
+++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
@@ -107,6 +107,8 @@ It&#39;s possible that a new user will start to modify EC2 instances when they h
 | 42.0 | 70 | 60 | User $user$ is modifying an instance $dest$ for the first time. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
index f4c0fbe13c..16079da667 100644
--- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
+++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
@@ -74,6 +74,8 @@ unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
index 14c665d98a..408775f3bd 100644
--- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
+++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
@@ -89,6 +89,8 @@ While this search has no known false positives, it is possible that a GCP admin
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
index fedd690d65..931f8d21a0 100644
--- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
+++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
@@ -71,7 +71,6 @@ Note that `detect_gcp_storage_access_from_a_new_ip_filter` is a empty macro by d
 #### Lookups
 The SPL above uses the following Lookups:
 
-* [previously_seen_gcp_storage_access_from_remote_ip](https://github.com/splunk/security_content/blob/develop/lookups/previously_seen_gcp_storage_access_from_remote_ip.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/previously_seen_gcp_storage_access_from_remote_ip.csv)
 * [previously_seen_gcp_storage_access_from_remote_ip](https://github.com/splunk/security_content/blob/develop/lookups/previously_seen_gcp_storage_access_from_remote_ip.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/previously_seen_gcp_storage_access_from_remote_ip.csv)
 
 #### Required field
@@ -99,6 +98,8 @@ GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow i
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md
index d3149ab70a..0c0affcd73 100644
--- a/docs/_posts/2020-08-11-detect_arp_poisoning.md
+++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md
@@ -99,6 +99,8 @@ This search might be prone to high false positives if DHCP Snooping or ARP inspe
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
index 05f56898c8..ad46b2f7b8 100644
--- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
+++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
@@ -91,6 +91,8 @@ This search might be prone to high false positives if DHCP Snooping has been inc
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
index 318efa433e..d608b315f6 100644
--- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
+++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
@@ -101,6 +101,8 @@ This is a strictly behavioral search, so we define &#34;false positive&#34; slig
 | 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
index 21f87098ed..a6d25cadc8 100644
--- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
+++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
@@ -103,6 +103,8 @@ This is a strictly behavioral search, so we define &#34;false positive&#34; slig
 | 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
index 5940234596..cc144f830a 100644
--- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
+++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
@@ -101,6 +101,8 @@ Many service accounts configured within a cloud infrastructure are known to exhi
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
index 82d970f5a6..07a2a6ecc6 100644
--- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
+++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
@@ -102,6 +102,8 @@ Many service accounts configured within an AWS infrastructure are known to exhib
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md
index 322ec6b390..bfef2b3a5c 100644
--- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md
+++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md
@@ -76,6 +76,8 @@ Because of imbalance of anomaly data in training, the model will less likely rep
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md b/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md
index 279195b74f..a8c7f7b4b9 100644
--- a/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md
+++ b/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md
@@ -107,6 +107,8 @@ None
 | 56.0 | 70 | 80 | A system process $process_name$ with commandline $cmd_line$ spawn in non-default folder path in host $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-08-25-unusual_lolbas_in_short_period_of_time.md b/docs/_posts/2020-08-25-unusual_lolbas_in_short_period_of_time.md
index 528fce7e55..a927fb39b3 100644
--- a/docs/_posts/2020-08-25-unusual_lolbas_in_short_period_of_time.md
+++ b/docs/_posts/2020-08-25-unusual_lolbas_in_short_period_of_time.md
@@ -91,6 +91,8 @@ Some administrative tasks may involve multiple use of LOLBAS applications in a s
 | 25.0 | 50 | 50 | A system process $process_name$ with commandline $cmd_line$ spawn iin short period of time in host $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
index c9bc14e27a..25c8be3565 100644
--- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
+++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
@@ -95,6 +95,8 @@ It&#39;s possible that a user has unknowingly started an instance in a new regio
 | 42.0 | 70 | 60 | User $user$ is creating an instance $dest$ in a new region for the first time |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
index adf8061f2b..a54753a5cb 100644
--- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
+++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
@@ -99,6 +99,8 @@ You must be ingesting your cloud infrastructure logs from your cloud provider.
 | 36.0 | 60 | 60 | User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
index fc57c804cd..76971e4519 100644
--- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
+++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
@@ -104,6 +104,8 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
 | 15.0 | 30 | 50 | user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
index 04d5b163ee..6171b9d95b 100644
--- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
+++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
@@ -105,6 +105,8 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
 | 15.0 | 30 | 50 | user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
index 37cfa4fa3d..572695b587 100644
--- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
+++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
@@ -87,6 +87,8 @@ It is possible that an admin will create a new system using a new instance type
 | 30.0 | 50 | 60 | User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
index 5ef8f28acd..58ac2575e2 100644
--- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
+++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
@@ -76,6 +76,8 @@ unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
index 2b9a1fff54..50661ff540 100644
--- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
+++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
@@ -98,6 +98,8 @@ Administrators often leverage net.exe to create or delete network shares. You sh
 | 25.0 | 50 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
index d042182027..712c18cfda 100644
--- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
+++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
@@ -84,6 +84,8 @@ None thus far found
 | 49.0 | 70 | 70 | The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
index be200b8866..cd08353b6c 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
@@ -100,6 +100,8 @@ When a legitimate new user logins for the first time, this activity will be dete
 | 18.0 | 30 | 60 | User $user$ is logging into the AWS console from City $City$ for the first time |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
index 86d9ccef2e..47b3f573b2 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
@@ -100,6 +100,8 @@ When a legitimate new user logins for the first time, this activity will be dete
 | 42.0 | 70 | 60 | User $user$ is logging into the AWS console from Country $Country$ for the first time |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
index c6a060077f..e1cd06a4c3 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
@@ -100,6 +100,8 @@ When a legitimate new user logins for the first time, this activity will be dete
 | 36.0 | 60 | 60 | User $user$ is logging into the AWS console from Region $Region$ for the first time |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
index ccc371a6f9..bff0afad11 100644
--- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
+++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
@@ -83,6 +83,8 @@ Payload.request.function.timeout value can possibly be match with other function
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
index 221794b79f..6acbb8edca 100644
--- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
+++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
@@ -103,6 +103,8 @@ This is a strictly behavioral search, so we define &#34;false positive&#34; slig
 | 18.0 | 30 | 60 | User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
index 206c30f0dc..1b3ec960ca 100644
--- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
+++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
@@ -102,6 +102,8 @@ This is a strictly behavioral search, so we define &#34;false positive&#34; slig
 | 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
index fe82571a0e..e20802e283 100644
--- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
+++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
@@ -92,6 +92,8 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea
 | 49.0 | 70 | 70 | The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md
index c90715d4c2..9ed99bc712 100644
--- a/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md
+++ b/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md
@@ -89,6 +89,8 @@ Older systems that support kerberos RC4 by default NetApp may generate false pos
 | 72.0 | 90 | 80 | Potential kerberoasting attack via service principal name requests detected on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-21-detect_kerberoasting.md b/docs/_posts/2020-10-21-detect_kerberoasting.md
index 91b3dfab1b..ac558b4614 100644
--- a/docs/_posts/2020-10-21-detect_kerberoasting.md
+++ b/docs/_posts/2020-10-21-detect_kerberoasting.md
@@ -92,6 +92,8 @@ Older systems that support kerberos RC4 by default NetApp may generate false pos
 | 14.0 | 70 | 20 | Kerberoasting malware is potentially applying stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
index eaf0ed902d..4a5f5a5d5c 100644
--- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
+++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
@@ -88,6 +88,8 @@ Unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
index 68d02f63e0..f97b961bed 100644
--- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
+++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
@@ -104,6 +104,8 @@ None currently known
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md
index 2db24011cc..b6b8fae8a8 100644
--- a/docs/_posts/2020-10-28-detect_port_security_violation.md
+++ b/docs/_posts/2020-10-28-detect_port_security_violation.md
@@ -103,6 +103,8 @@ This search might be prone to high false positives if you have malfunctioning de
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
index 781679351a..ca84b61019 100644
--- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
+++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
@@ -89,6 +89,8 @@ This search will also report any legitimate attempts of software downloads to ne
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
index 1db9849eb6..ee0a057eea 100644
--- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md
+++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
@@ -91,6 +91,8 @@ This search will return false positives for any legitimate traffic captures by n
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
index ba81fc858e..5b0c21a34a 100644
--- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md
+++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
@@ -83,6 +83,8 @@ If there are files with this keywoord as file names it might trigger false possi
 | 70.0 | 70 | 100 | A creation of ryuk test file $file_path$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
index 76641c3c31..e2f2336e14 100644
--- a/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
+++ b/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
@@ -92,6 +92,8 @@ Administrators may attempt to change the default execution policy on a system fo
 | 48.0 | 60 | 80 | A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
index 8a3f6289c7..a0eae2ff28 100644
--- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
+++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
@@ -84,6 +84,8 @@ SAM is a critical windows service, stopping it would cause major issues on an en
 | 70.0 | 70 | 100 | The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md
index d43c67c5b2..eaf05768cd 100644
--- a/docs/_posts/2020-11-09-common_ransomware_extensions.md
+++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md
@@ -100,6 +100,8 @@ It is possible for a legitimate file with these extensions to be created. If thi
 | 90.0 | 90 | 100 | A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md
index b24b64ffbc..3913ec95f6 100644
--- a/docs/_posts/2020-11-09-common_ransomware_notes.md
+++ b/docs/_posts/2020-11-09-common_ransomware_notes.md
@@ -95,6 +95,8 @@ It&#39;s possible that a legitimate file could be created with the same name use
 | 90.0 | 90 | 100 | A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md
index ad23a6ce73..c76e1529a4 100644
--- a/docs/_posts/2020-11-09-deleting_shadow_copies.md
+++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md
@@ -95,6 +95,8 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions
 | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
index aa00009ab1..632344edcb 100644
--- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
+++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
@@ -100,6 +100,8 @@ It&#39;s possible that a widely used system, such as a kiosk, could cause a larg
 | 36.0 | 60 | 60 | Multiple accounts have been locked out. Review $dest$ and results related to $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
index 9932ebf456..e98e783b6b 100644
--- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
+++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
@@ -99,6 +99,8 @@ It is uncommon for normal users to execute a series of commands used for network
 | 32.0 | 40 | 80 | An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
index 290a04a004..09b9bf4dcc 100644
--- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
@@ -86,6 +86,8 @@ There are circumstances where an application may legitimately execute and intera
 | 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants investigating. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
index ef8c5de8b7..b668f55369 100644
--- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
+++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
@@ -91,6 +91,8 @@ This registry key may be modified via administrators to implement a change in sy
 | 42.0 | 70 | 60 | The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
index 5124e0ddf9..353903eebc 100644
--- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
+++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
@@ -90,6 +90,8 @@ None identified.
 | 56.0 | 80 | 70 | process $process$ have double extensions in the file name is executed on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
index 7e9b0800d9..544e81dc76 100644
--- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
+++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
@@ -91,6 +91,8 @@ None identified
 | 63.0 | 70 | 90 | A process $process_name$ that possible create a shim db silently in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
index 656d5a3574..c8c9643e14 100644
--- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
+++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
@@ -96,6 +96,8 @@ It is unusual for a service to be created or modified by directly manipulating t
 | 45.0 | 75 | 60 | A reg.exe process $process_name$ with commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
index 4e44caf07e..520d87b135 100644
--- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
+++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
@@ -95,6 +95,8 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma
 | 56.0 | 70 | 80 | A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md
index 34a4be73a2..5fff61547d 100644
--- a/docs/_posts/2020-12-08-shim_database_file_creation.md
+++ b/docs/_posts/2020-12-08-shim_database_file_creation.md
@@ -90,6 +90,8 @@ Because legitimate shim files are created and used all the time, this event, in
 | 56.0 | 70 | 80 | A process that possibly write shim database in $file_path$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
index a70ffa2fbe..6e8b75dc0f 100644
--- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
+++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
@@ -92,6 +92,8 @@ Single-letter executables are not always malicious. Investigate this activity wi
 | 63.0 | 70 | 90 | A suspicious process $process_name$ with single letter in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
index e290aacc01..8b8b3a208b 100644
--- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
+++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
@@ -104,6 +104,8 @@ This detection may require tuning based on third party applications utilizing na
 | 49.0 | 70 | 70 | System process running from unexpected location on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md
index ce3469275f..ad68228635 100644
--- a/docs/_posts/2020-12-08-unusually_long_command_line.md
+++ b/docs/_posts/2020-12-08-unusually_long_command_line.md
@@ -85,6 +85,8 @@ Some legitimate applications start with long command lines.
 | 42.0 | 70 | 60 | Unusually long command line $Processes.process_name$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
index 481762c613..ec4742bfe7 100644
--- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
+++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
@@ -96,6 +96,8 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
 | 30.0 | 30 | 100 | User $user$ on $host$ executed the following suspicious WMI query: $Query$.  Filter: $filter$. Consumer: $Consumer$.  EventCode: $EventCode$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
index 79ecf90ed5..060292b09e 100644
--- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
+++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
@@ -81,6 +81,8 @@ unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
index ca41bf7cfe..04bde8ed49 100644
--- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
+++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
@@ -89,6 +89,8 @@ Service Accounts
 | 48.0 | 80 | 60 | User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
index 8260fbfc93..62ffbded74 100644
--- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
+++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
@@ -87,6 +87,8 @@ unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md b/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md
index 80be2b8a77..d1bf5ff0c0 100644
--- a/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md
+++ b/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md
@@ -87,6 +87,8 @@ The threshold for alert is above 10 attempts and this should reduce the number o
 | 64.0 | 80 | 80 | User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md
index d271a1647c..5c3b66c80a 100644
--- a/docs/_posts/2020-12-16-o365_pst_export_alert.md
+++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md
@@ -87,6 +87,8 @@ PST export can be done for legitimate purposes but due to the sensitive nature o
 | 48.0 | 80 | 60 | User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
index a00ebd9794..7de46cf473 100644
--- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
+++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
@@ -91,6 +91,8 @@ unknown
 | 48.0 | 80 | 60 | User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
index 827517be27..fa5b6c1462 100644
--- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
+++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
@@ -91,6 +91,8 @@ unknown
 | 48.0 | 80 | 60 | User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md
index 3919624069..bfb047be62 100644
--- a/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md
+++ b/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md
@@ -96,6 +96,8 @@ Tasks should not be manually created via CLI, this is rarely done by admins as w
 | 56.0 | 70 | 80 | A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
index b63021ff09..52c6edf2ab 100644
--- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
+++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
@@ -87,6 +87,8 @@ Administrators may modify the boot configuration.
 | 80.0 | 100 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md
index c5ff556d0e..8878cae96c 100644
--- a/docs/_posts/2021-01-06-supernova_webshell.md
+++ b/docs/_posts/2021-01-06-supernova_webshell.md
@@ -79,6 +79,8 @@ There might be false positives associted with this detection since items like ar
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
index 27d3299fb8..7c363796e9 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
@@ -92,6 +92,8 @@ unknown
 | 25.0 | 50 | 50 | AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
index 6c4f44912a..b2f5010846 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
@@ -87,6 +87,8 @@ bucket with S3 encryption
 | 15.0 | 30 | 50 | User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
index 0501524009..1e0c3ceca3 100644
--- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
+++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
@@ -98,6 +98,8 @@ It&#39;s possible that an admin has created this ACL with all ports open for som
 | 48.0 | 60 | 80 | User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
index 90481fd30d..778517ceb6 100644
--- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
+++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
@@ -91,6 +91,8 @@ It&#39;s possible that a user has legitimately deleted a network ACL.
 | 5.0 | 10 | 50 | User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
index daae7b88bc..6b01746d49 100644
--- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
+++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
@@ -93,6 +93,8 @@ Although unlikely, limited instances have been identified coming from native Mic
 | 35.0 | 70 | 50 | Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_path.md b/docs/_posts/2021-01-12-suspicious_msbuild_path.md
index 5b8d0c02ef..dfaa95b20b 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_path.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_path.md
@@ -107,6 +107,8 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f
 | 49.0 | 70 | 70 | Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
index 23ea599cce..9413aedc4e 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
@@ -107,6 +107,8 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild,
 | 63.0 | 70 | 90 | Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
index e6c4885ebb..b4ac3fdf44 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
@@ -97,6 +97,8 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
 | 42.0 | 70 | 60 | Suspicious msbuild.exe process executed on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
index 60472da69b..aec552e8c6 100644
--- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
+++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
@@ -91,6 +91,8 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
 | 40.0 | 50 | 80 | suspicious mshta child process detected on host $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
index 7d76860d9e..ca70bfc371 100644
--- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
+++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
@@ -103,6 +103,8 @@ Some users and applications may leverage Dynamic DNS to reach out to some domain
 | 56.0 | 70 | 80 | A dns query $query$ from your infra connecting to suspicious domain in host  $host$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
index aa40219ba0..9723b2760d 100644
--- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
+++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
@@ -100,6 +100,8 @@ These characters might be legitimately on the command-line, but it is not common
 | 42.0 | 70 | 60 | Powershell.exe running with potential obfuscated arguments on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
index 92bd572314..d6c26640ad 100644
--- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
+++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
@@ -98,6 +98,8 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
 | 56.0 | 70 | 80 | Suspicious rundll32.exe inline HTA execution on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
index a68360f0a5..f85a5cae16 100644
--- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
+++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
@@ -97,6 +97,8 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
 | 42.0 | 70 | 60 | mshta.exe spawned by wmiprvse.exe on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
index 8d9127dfaf..890889c8e9 100644
--- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
+++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
@@ -87,6 +87,8 @@ Administrators may modify the boot configuration.
 | 15.0 | 30 | 50 | System backups deletion on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
index 6ab95ee750..1d78896c91 100644
--- a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
+++ b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
@@ -91,6 +91,8 @@ Administrators may use nltest for troubleshooting purposes, otherwise, rarely us
 | 15.0 | 30 | 50 | Domain trust discovery execution on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
index 1f070ebcec..c6f9e89788 100644
--- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
+++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
@@ -90,6 +90,8 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff
 | 64.0 | 80 | 80 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
index 85af5f6d57..d1ba287ca0 100644
--- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
+++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
@@ -89,6 +89,8 @@ Updating a SAML provider or creating a new one may not necessarily be malicious
 | 64.0 | 80 | 80 | User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
index c5fd69aeed..5ec24f4b34 100644
--- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
+++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
@@ -83,6 +83,8 @@ Unless there are specific use cases, manipulating or exporting certificates usin
 | 63.0 | 90 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
index f414d083c6..6200a45168 100644
--- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
+++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
@@ -80,6 +80,8 @@ None
 | 15.0 | 30 | 50 | Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
index d9c002d920..635f171522 100644
--- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
+++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
@@ -72,6 +72,8 @@ None
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
index 2f173a8259..4b2ec9be2f 100644
--- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
+++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
@@ -92,6 +92,8 @@ The creation of a new Federation is not necessarily malicious, however this even
 | 18.0 | 30 | 60 | User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
index d21d8a1de2..aede587463 100644
--- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
+++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
@@ -89,6 +89,8 @@ Logon errors may not be malicious in nature however it may indicate attempts to
 | 64.0 | 80 | 80 | User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
index a107f285b4..5a863cdab9 100644
--- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
+++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
@@ -93,6 +93,8 @@ The creation of a new Federated domain is not necessarily malicious, however the
 | 64.0 | 80 | 80 | User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-26-revil_registry_entry.md b/docs/_posts/2021-01-26-revil_registry_entry.md
index 91dc707482..412b745317 100644
--- a/docs/_posts/2021-01-26-revil_registry_entry.md
+++ b/docs/_posts/2021-01-26-revil_registry_entry.md
@@ -91,6 +91,8 @@ unknown
 | 60.0 | 60 | 100 | A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
index 6d86259c4f..0a2527ecde 100644
--- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
+++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
@@ -73,6 +73,8 @@ unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
index 5456b359c8..6f479f7245 100644
--- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
+++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
@@ -74,6 +74,8 @@ unknown
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
index a625b55a31..da01973045 100644
--- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
+++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
@@ -99,6 +99,8 @@ Limited false positives related to third party software registering .DLL&#39;s.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
index 5c9793da42..5eaf8e0f7b 100644
--- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
+++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
@@ -95,6 +95,8 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener
 | 50.0 | 100 | 50 | Active Directory NTDS export on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
index 6e457f0dde..8cd015315d 100644
--- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
+++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
@@ -98,6 +98,8 @@ Limited false positives with the query restricted to specified paths. Add more w
 | 35.0 | 70 | 50 | Suspicious $Processes.process_path.file_path$ process potentially loading malicious code |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
index 129e3f94ec..ea4fb3c5bd 100644
--- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
+++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
@@ -76,6 +76,8 @@ If sudoedit is throwing segfaults for other reasons this will pick those up too.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
index a5d64251bb..6fca2af169 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
@@ -97,6 +97,8 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
index 75cf61c6b1..53f3b473ed 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
@@ -97,6 +97,8 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
index 9995c74278..7de42141b4 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
@@ -97,6 +97,8 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
index df5b7c1427..84b7edf779 100644
--- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
+++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
@@ -99,6 +99,8 @@ Although unlikely, some legitimate applications may use Start as a function and
 | 35.0 | 70 | 50 | rundll32.exe running with suspicious parameters on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
index b2f8d76426..f2238e4931 100644
--- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
+++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
@@ -97,6 +97,8 @@ This is likely to produce false positives and will require some filtering. Tune
 | 35.0 | 70 | 50 | $Processes.process_path.file_path$ process potentially loading malicious code |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
index 281d4edb0f..109b8fc446 100644
--- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
+++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
@@ -96,6 +96,8 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
index a202ae9c5e..cfdc8e0ab1 100644
--- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
@@ -92,6 +92,8 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa
 | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
index 3fca77c1f7..6b3995b061 100644
--- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
@@ -93,6 +93,8 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa
 | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$  was identified on endpoint $dest$ by user $user$ typically not normal for this process. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md b/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md
index 9311d225c8..d221b02118 100644
--- a/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md
+++ b/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md
@@ -92,6 +92,8 @@ Although unlikely, limited instances of regasm.exe with a network connection may
 | 80.0 | 80 | 100 | An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md b/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md
index e554c387a6..57f94297ac 100644
--- a/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md
+++ b/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md
@@ -91,6 +91,8 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive.
 | 80.0 | 80 | 100 | An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
index 6d9c365300..da31deb082 100644
--- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
+++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
@@ -98,6 +98,8 @@ While this search has no known false positives, it is possible that an AWS admin
 | 49.0 | 70 | 70 | User $user$ created a policy version that allows them to access any resource in their account |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
index 0c447dcf0b..686b3f5207 100644
--- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
+++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
@@ -90,6 +90,8 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some
 | 72.0 | 80 | 90 | An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
index e27ff20cfd..050828d0cf 100644
--- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
+++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
@@ -85,6 +85,8 @@ Unknown. Filter as needed.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
index 66c80f2b20..fce8fd9384 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
@@ -97,6 +97,8 @@ Some legitimate applications may use PlistBuddy to create or modify property lis
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
index fd5c3c0389..889c287c58 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
@@ -85,6 +85,8 @@ Some legitimate applications may use PlistBuddy to create or modify property lis
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
index 4202b50957..2df145bac5 100644
--- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
+++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
@@ -84,6 +84,8 @@ Unknown.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md
index 80d4b932d4..945783002e 100644
--- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md
+++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md
@@ -100,6 +100,8 @@ False positives may be present and filtering will need to occur by parent proces
 | 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-03-01-any_powershell_downloadstring.md b/docs/_posts/2021-03-01-any_powershell_downloadstring.md
index 39e95861b2..5f1068053b 100644
--- a/docs/_posts/2021-03-01-any_powershell_downloadstring.md
+++ b/docs/_posts/2021-03-01-any_powershell_downloadstring.md
@@ -99,6 +99,8 @@ False positives may be present and filtering will need to occur by parent proces
 | 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
index 83ea873a58..912861ba77 100644
--- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
+++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
@@ -105,6 +105,8 @@ Limited to no false positives are expected.
 | 81.0 | 90 | 90 | Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
index 609e91a902..d0c3276678 100644
--- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
+++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
@@ -94,6 +94,8 @@ Limited to no known false positives.
 | 63.0 | 70 | 90 | A process $process_name$ with wake on LAN commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
index b6eb609c7b..925d2ccbaf 100644
--- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
+++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
@@ -100,6 +100,8 @@ Limited false positives may be present. Filter as needed by parent process or co
 | 35.0 | 70 | 50 | Suspicious scheduled task registered on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
index 68580045bf..434f012346 100644
--- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
+++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
@@ -95,6 +95,8 @@ While this search has no known false positives, it is possible that an AWS admin
 | 30.0 | 50 | 60 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
index 8ced3b6b48..a48b3a267c 100644
--- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
+++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
@@ -89,6 +89,8 @@ Unknown. Tune out child processes as needed to limit volume of false positives.
 | 56.0 | 70 | 80 | Possible CVE-2021-26857 exploitation on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
index 478fc1bb35..1c031c56dc 100644
--- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
+++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
@@ -91,6 +91,8 @@ It is unusual to turn this feature off a Windows system since it is a default se
 | 24.0 | 30 | 80 | Windows DisableAntiSpyware registry key set to &#39;disabled&#39; on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
index 3839c46625..1bebbdd826 100644
--- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
+++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
@@ -97,6 +97,8 @@ Limited false positives may be present. Filter as needed based on initial analys
 | 42.0 | 70 | 60 | Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
index 45e83e2b38..e32c4a77f3 100644
--- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md
+++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
@@ -102,6 +102,8 @@ Baseline your environment before production. It is possible build systems using
 | 56.0 | 70 | 80 | Possible Web Shell execution on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
index 79ee7a96a0..d307de8981 100644
--- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
+++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
@@ -90,6 +90,8 @@ unknown
 | 81.0 | 90 | 90 | A high frequency file creation of $file_name$ in different file path in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
index 9abbb94fb4..e415efba99 100644
--- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
@@ -87,6 +87,8 @@ network admin can resize the shadowstorage for valid purposes.
 | 72.0 | 80 | 90 | A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-16-high_file_deletion_frequency.md b/docs/_posts/2021-03-16-high_file_deletion_frequency.md
index b1ba84e878..55f63f1698 100644
--- a/docs/_posts/2021-03-16-high_file_deletion_frequency.md
+++ b/docs/_posts/2021-03-16-high_file_deletion_frequency.md
@@ -88,6 +88,8 @@ user may delete bunch of pictures or files in a folder.
 | 72.0 | 90 | 80 | High frequency file deletion activity detected on host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md
index 1dfa1d3685..dd0e389b58 100644
--- a/docs/_posts/2021-03-16-high_process_termination_frequency.md
+++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md
@@ -86,6 +86,8 @@ admin or user tool that can terminate multiple process.
 | 72.0 | 90 | 80 | High frequency process termination (more than 15 processes within 3s) detected on host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
index 9ff0e39833..8ffcc0ab77 100644
--- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md
+++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
@@ -92,6 +92,8 @@ Operators can execute third party tools using these parameters.
 | 100.0 | 100 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
index 3187904952..1663c0ce0f 100644
--- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
+++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
@@ -87,6 +87,8 @@ unknown
 | 100.0 | 100 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md b/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md
index 4746685d8c..bd124a4d8e 100644
--- a/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md
+++ b/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md
@@ -93,6 +93,8 @@ unknown
 | 60.0 | 60 | 100 | A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
index be06dcb77a..156161fa1b 100644
--- a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
@@ -94,6 +94,8 @@ Limited false positives in most environments, however tune as needed based on pa
 | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
index 3bba649773..fb296b4edf 100644
--- a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
@@ -94,6 +94,8 @@ Limited false positives in most environments, however tune as needed based on pa
 | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
index 1683a7cd83..2c9fe448d5 100644
--- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md
+++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
@@ -93,6 +93,8 @@ Typically seen used to `encode` files, but it is possible to see legitimate use
 | 40.0 | 50 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
index 0fbed53d8f..074ac10e61 100644
--- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
+++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
@@ -94,6 +94,8 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr
 | 56.0 | 70 | 80 | A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
index 5dd055e378..0a87046c68 100644
--- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
+++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
@@ -92,6 +92,8 @@ This detection will require tuning to provide high fidelity detection capabiltie
 | 5.0 | 10 | 50 | User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
index 638189f50e..63aee91568 100644
--- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
+++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
@@ -97,6 +97,8 @@ admin may disable firewall during testing or fixing network problem.
 | 25.0 | 50 | 50 | The Windows Firewall was disabled on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
index b8bcb7c42f..0a07116959 100644
--- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md
+++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
@@ -94,6 +94,8 @@ Limited false positives. If there is a true false positive, filter based on comm
 | 72.0 | 80 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
index c863e6d360..94e244fc3b 100644
--- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
+++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
@@ -89,6 +89,8 @@ This detection will require tuning to provide high fidelity detection capabiltie
 | 28.0 | 40 | 70 | User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
index 7918c72dc9..86ff2df95a 100644
--- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md
+++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
@@ -84,6 +84,8 @@ This detection will require tuning to provide high fidelity detection capabiltie
 | 10.0 | 20 | 50 | User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
index 38bc84981c..e6353a741a 100644
--- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
+++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
@@ -84,6 +84,8 @@ This detection will require tuning to provide high fidelity detection capabiltie
 | 5.0 | 10 | 50 | User $user_arn$ has had mulitple failures while attempting to delete groups from $src$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
index 9ed093a7e9..d0fbf67a01 100644
--- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
+++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
@@ -100,6 +100,8 @@ Creating a hidden powershell service is rare and could key off of those instance
 | 72.0 | 90 | 80 | Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
index 1f711a83ac..c7c5802ed9 100644
--- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
+++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
@@ -92,6 +92,8 @@ A host failing to authenticate with multiple valid domain users is not a common
 | 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
index 207014cc67..aa21571d8a 100644
--- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
+++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
@@ -101,6 +101,8 @@ False positives are possible if legitimate applications are allowed to register
 | 70.0 | 70 | 100 | A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md
index 0e775ad60c..0f6a43a4e0 100644
--- a/docs/_posts/2021-04-12-excel_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md
@@ -96,6 +96,8 @@ False positives should be limited, but if any are present, filter as needed.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
index 5159b09a09..46f2cd1029 100644
--- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
@@ -91,6 +91,8 @@ False positives should be limited, but if any are present, filter as needed. In
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
index 589fd0ecd7..269dec3e49 100644
--- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
+++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
@@ -99,6 +99,8 @@ False positives are possible if legitimate applications are allowed to register
 | 70.0 | 70 | 100 | A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md
index cff7381200..c65d1d32a2 100644
--- a/docs/_posts/2021-04-12-winword_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md
@@ -97,6 +97,8 @@ False positives should be limited, but if any are present, filter as needed.
 | 70.0 | 70 | 100 | $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
index 1329d297e5..b526cd1f1e 100644
--- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
@@ -91,6 +91,8 @@ There will be limited false positives and it will be different for every environ
 | 70.0 | 70 | 100 | User $user$ on $dest$ spawned Windows Script Host from Winword.exe |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
index 7c16d020c3..e98981b401 100644
--- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
+++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
@@ -86,6 +86,8 @@ While this search has no known false positives.
 | 18.0 | 30 | 60 | user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50,  using the following commands $command$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md
index bb808deb34..a10acfa092 100644
--- a/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md
+++ b/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md
@@ -95,6 +95,8 @@ A source user failing attempting to authenticate multiple users on a host is not
 | 49.0 | 70 | 70 | Potential password spraying attack from $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
index cc15e9b7f4..3606f1b8de 100644
--- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
+++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
@@ -92,6 +92,8 @@ A host failing to authenticate with multiple valid domain users is not a common
 | 49.0 | 70 | 70 | Potential NTLM based password spraying attack from $Source_Workstation$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
index 17e38976e8..cc1f8cd7fa 100644
--- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
+++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
@@ -96,6 +96,8 @@ A process failing to authenticate with multiple users is not a common behavior f
 | 49.0 | 70 | 70 | Potential password spraying attack from $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
index 530308b663..ca81a6baee 100644
--- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
+++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
@@ -95,6 +95,8 @@ A host failing to authenticate with multiple valid users against a remote host i
 | 49.0 | 70 | 70 | Potential password spraying attack on $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
index be11100b30..03cc231ecf 100644
--- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
+++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
@@ -98,6 +98,8 @@ unknown
 | 63.0 | 70 | 90 | Office application spawning rundll32.exe on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md
index 05ffe64130..16ed3b7b2d 100644
--- a/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md
+++ b/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md
@@ -92,6 +92,8 @@ A host failing to authenticate with multiple disabled domain users is not a comm
 | 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md
index eefe7e5904..ce78cbe812 100644
--- a/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md
+++ b/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md
@@ -92,6 +92,8 @@ A host failing to authenticate with multiple invalid domain users is not a commo
 | 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
index 40a98dea08..d13530444c 100644
--- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
+++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
@@ -92,6 +92,8 @@ unknown
 | 49.0 | 70 | 70 | Office document creating a schedule task on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
index b81a360f72..1e321bbc7f 100644
--- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md
+++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
@@ -94,6 +94,8 @@ Normal Office Document macro use for automation
 | 35.0 | 70 | 50 | Office document executing a macro on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
index de950203dc..f945f2015f 100644
--- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
+++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
@@ -95,6 +95,8 @@ admin nslookup usage
 | 72.0 | 90 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
index 52737fa38b..4a964a2089 100644
--- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
+++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
@@ -92,6 +92,8 @@ A host failing to authenticate with multiple invalid domain users is not a commo
 | 49.0 | 70 | 70 | Potential NTLM based password spraying attack from $Source_Workstation$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md
index a111143787..81a406d4af 100644
--- a/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md
@@ -94,6 +94,8 @@ Limited false positives may be present in small environments. Tuning may be requ
 | 81.0 | 90 | 90 | Process gpupdate.exe  with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
index 25a33b6e2e..4db68846fe 100644
--- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
+++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
@@ -91,6 +91,8 @@ unknown
 | 63.0 | 70 | 90 | A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
index 35beaa31ba..ffa2466e24 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
@@ -91,6 +91,8 @@ unknown
 | 63.0 | 70 | 90 | A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
index 43f8ba7e70..71eb8d206a 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
@@ -93,6 +93,8 @@ unknown
 | 70.0 | 70 | 100 | A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
index 4353e4b153..cc86935ad6 100644
--- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
+++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
@@ -92,6 +92,8 @@ unknown
 | 56.0 | 70 | 80 | Wermgr.exe process connecting IP location web services on $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
index 5c49ee8e5a..e3d3c14052 100644
--- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
+++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
@@ -86,6 +86,8 @@ unknown
 | 56.0 | 70 | 80 | Wermgr.exe writing executable files on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
index a669df4f04..e15ff1883b 100644
--- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
+++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
@@ -94,6 +94,8 @@ unknown
 | 56.0 | 70 | 80 | Wermgr.exe spawning suspicious processes on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
index fa5d8c389a..39d91a7e1a 100644
--- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
+++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
@@ -91,6 +91,8 @@ unknown
 | 28.0 | 40 | 70 | Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
index df21da7db7..8b103739e9 100644
--- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
+++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
@@ -97,6 +97,8 @@ Normal archive transfer via HTTP protocol may trip this detection.
 | 25.0 | 50 | 50 | A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
index 08ee666da8..f0dee5531a 100644
--- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
+++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
@@ -95,6 +95,8 @@ False positives should be limited as this behavior is not normal for `rundll32.e
 | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
index 004a7c1a84..5b2f4e0742 100644
--- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
+++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
@@ -97,6 +97,8 @@ False positives should be limited, but if any are present, filter as needed.
 | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
index d37165e880..ab515ef8ad 100644
--- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
+++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
@@ -91,6 +91,8 @@ unknown
 | 63.0 | 70 | 90 | A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md
index 46ae09a583..8d92460f97 100644
--- a/docs/_posts/2021-04-22-winword_spawning_cmd.md
+++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md
@@ -97,6 +97,8 @@ False positives should be limited, but if any are present, filter as needed.
 | 70.0 | 70 | 100 | $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
index c4d8b8ac61..b31d96d2ec 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
@@ -97,6 +97,8 @@ No false positives known. Filter as needed.
 | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
index 3f73b7a5ec..6cfc38751a 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
@@ -97,6 +97,8 @@ No false positives known. Filter as needed.
 | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
index 846a587b19..924affc261 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
@@ -98,6 +98,8 @@ No false positives known. Filter as needed.
 | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md
index 5cc73b7267..3141c7a4bb 100644
--- a/docs/_posts/2021-04-26-trickbot_named_pipe.md
+++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md
@@ -88,6 +88,8 @@ unknown
 | 42.0 | 70 | 60 | Possible Trickbot namedpipe created on $Computer$ by $Image$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md
index 1121bb17b2..134253e594 100644
--- a/docs/_posts/2021-04-29-icacls_deny_command.md
+++ b/docs/_posts/2021-04-29-icacls_deny_command.md
@@ -87,6 +87,8 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed
 | 72.0 | 90 | 80 | Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
index e337b3ed4d..fc3daf6186 100644
--- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
+++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
@@ -92,6 +92,8 @@ Limited false positives will be present. Some applications do load drivers
 | 63.0 | 70 | 90 | Suspicious driver $ImageLoaded$ on $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
index 4257b5fd09..b0c6e51b57 100644
--- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md
+++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
@@ -92,6 +92,8 @@ False positives should be limited.
 | 80.0 | 80 | 100 | A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md
index 8b92872002..f297fee0fe 100644
--- a/docs/_posts/2021-05-04-deleting_of_net_users.md
+++ b/docs/_posts/2021-05-04-deleting_of_net_users.md
@@ -93,6 +93,8 @@ System administrators or scripts may delete user accounts via this technique. Fi
 | 25.0 | 50 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md
index 3e3d4f37f9..cfccd28f1a 100644
--- a/docs/_posts/2021-05-04-disabling_net_user_account.md
+++ b/docs/_posts/2021-05-04-disabling_net_user_account.md
@@ -93,6 +93,8 @@ unknown
 | 42.0 | 70 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
index cdcb82b674..8a10b3294e 100644
--- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
+++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
@@ -88,6 +88,8 @@ unknown
 | 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
index 4def015984..e7d34373ff 100644
--- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
+++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
@@ -95,6 +95,8 @@ unknown
 | 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
index 9240227142..e2828848da 100644
--- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
+++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
@@ -92,6 +92,8 @@ Unknown. Filter as needed.
 | 28.0 | 40 | 70 | Excessive usage  of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md
index 62c96cb39f..bf9491acc9 100644
--- a/docs/_posts/2021-05-04-icacls_grant_command.md
+++ b/docs/_posts/2021-05-04-icacls_grant_command.md
@@ -88,6 +88,8 @@ Unknown. Filter as needed.
 | 49.0 | 70 | 70 | Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md
index 08485be8ce..de7f112f59 100644
--- a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md
+++ b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md
@@ -87,6 +87,8 @@ administrators may use this command. Filter as needed.
 | 32.0 | 40 | 80 | Suspicious ACL permission modification on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
index 211503eced..09c1fb0bc7 100644
--- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
+++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
@@ -97,6 +97,8 @@ Unknown.
 | 56.0 | 70 | 80 | A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md
index 8691db51ea..00920c2384 100644
--- a/docs/_posts/2021-05-05-suspicious_process_file_path.md
+++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md
@@ -91,6 +91,8 @@ Administrators may allow execution of specific binaries in non-standard paths. F
 | 35.0 | 70 | 50 | Suspicioues process $Processes.process_path.file_path$ running from suspicious location |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md
index 3f62040f18..9e9cc3d5d9 100644
--- a/docs/_posts/2021-05-06-download_files_using_telegram.md
+++ b/docs/_posts/2021-05-06-download_files_using_telegram.md
@@ -86,6 +86,8 @@ normal download of file in telegram app. (if it was a common app in network)
 | 49.0 | 70 | 70 | Suspicious files were downloaded with the Telegram application on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
index 3fe5bf838f..18250b4522 100644
--- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
+++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
@@ -89,6 +89,8 @@ unknown
 | 80.0 | 80 | 100 | The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
index 9752b206bd..229ba6c348 100644
--- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
+++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
@@ -95,6 +95,8 @@ unknown. Filter as needed. Modify the time span as needed.
 | 28.0 | 40 | 70 | Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
index 2f7fd8871b..7a7af1f0e8 100644
--- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
+++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
@@ -88,6 +88,8 @@ Administrators may allow creation of script or exe in the paths specified. Filte
 | 56.0 | 80 | 70 | Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
index 01452a6d28..054c65a0ee 100644
--- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
+++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
@@ -88,6 +88,8 @@ Administrators or administrative scripts may use this application. Filter as nee
 | 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
index eaa197c8da..1ec915bc52 100644
--- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
+++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
@@ -89,6 +89,8 @@ Administrators may use to debug Schedule Task entries. Filter as needed.
 | 48.0 | 60 | 80 | A &#34;on demand&#34; execution of schedule task process $process_name$  using commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
index 39ab169950..158a6dec91 100644
--- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
+++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
@@ -86,6 +86,8 @@ unknown
 | 81.0 | 90 | 90 | An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
index 1509e1564e..c91234d397 100644
--- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
+++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
@@ -92,6 +92,8 @@ Legitimate windows application that are not on the list loading this dll. Filter
 | 80.0 | 80 | 100 | The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md
index 01c0553f43..09404d7ea2 100644
--- a/docs/_posts/2021-05-13-slui_runas_elevated.md
+++ b/docs/_posts/2021-05-13-slui_runas_elevated.md
@@ -95,6 +95,8 @@ Limited false positives should be present as this is not commonly used by legiti
 | 63.0 | 70 | 90 | A slui process $process_name$ with elevated commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md
index 8dfa9f720a..e5fd436a04 100644
--- a/docs/_posts/2021-05-13-slui_spawning_a_process.md
+++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md
@@ -95,6 +95,8 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi
 | 63.0 | 70 | 90 | A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md
index 2aa133a5e1..34e3a3d9d2 100644
--- a/docs/_posts/2021-05-18-services_escalate_exe.md
+++ b/docs/_posts/2021-05-18-services_escalate_exe.md
@@ -90,6 +90,8 @@ False positives should be limited as `services.exe` should never spawn a process
 | 76.0 | 80 | 95 | A service process $parent_process_name$ with process path $process_path$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
index f0688b1330..04491499df 100644
--- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
+++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
@@ -88,6 +88,8 @@ administrator may allow inbound traffic in certain network or machine.
 | 3.0 | 10 | 30 | Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
index 3543f22567..5f103be115 100644
--- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
+++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
@@ -88,6 +88,8 @@ unknown
 | 72.0 | 90 | 80 | mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
index 0f63afb952..b677ad5ad5 100644
--- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
+++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
@@ -108,6 +108,8 @@ Unknown. It is possible filtering may be required to ensure fidelity.
 | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
index 657ffff747..363830d202 100644
--- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md
+++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
@@ -87,6 +87,8 @@ Unknown. Add new processes or filter as needed. It is possible system management
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
index db302febaa..6b1cc44564 100644
--- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
+++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
@@ -93,6 +93,8 @@ unknown
 | 80.0 | 80 | 100 | A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
index e3520f70ac..f534f940a2 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
@@ -111,6 +111,8 @@ False positives should be limited as the analytic is specific to a filename with
 | 24.0 | 30 | 80 | Potential SharpHound file modifications identified on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md
index 9d5babeb3a..18cca8829c 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_usage.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md
@@ -117,6 +117,8 @@ False positives should be limited as this is specific to a file attribute not us
 | 24.0 | 30 | 80 | Potential SharpHound binary identified on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
index f8a9e9d194..1260b73b4a 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
@@ -116,6 +116,8 @@ Unknown.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
index f416331e92..f10997fc7d 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
@@ -110,6 +110,8 @@ False positives should be limited as the analytic is specific to a filename with
 | 63.0 | 70 | 90 | A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
index 87b295e673..6bd725e733 100644
--- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
@@ -113,6 +113,8 @@ False positives should be limited as the arguments used are specific to SharpHou
 | 24.0 | 30 | 80 | Possible SharpHound command-Line arguments identified on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
index 50acc69bf8..0b361de6c5 100644
--- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
@@ -92,6 +92,8 @@ To successfully implement this search, you need to be ingesting logs with the pr
 | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md
index b02c194e8a..40d1dac917 100644
--- a/docs/_posts/2021-06-02-modification_of_wallpaper.md
+++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md
@@ -90,6 +90,8 @@ To successfully implement this search, you need to be ingesting logs with the Im
 | 54.0 | 60 | 90 | Wallpaper modification on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
index ae9c1e4b26..0c44b850b3 100644
--- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
@@ -90,6 +90,8 @@ third party tool may have same command line parameters as revil ransomware.
 | 54.0 | 60 | 90 | A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
index 3509ede78c..61c4e7f489 100644
--- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
+++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
@@ -94,6 +94,8 @@ legitimate process that are not in the exception list may trigger this event.
 | 35.0 | 70 | 50 | Suspicious COM Object Execution on $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md b/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md
index 9077068608..4bc2be732e 100644
--- a/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md
+++ b/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md
@@ -85,6 +85,8 @@ Many benign applications will create processes from executables in Windows\Temp,
 | 80.0 | 80 | 100 | Multiple processes were executed out of windows\temp within a short amount of time on $dest$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
index 3caa32ea9b..e10fee8891 100644
--- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
+++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
@@ -85,6 +85,8 @@ Admin activities or installing related updates may do a sudden stop to list of s
 | 72.0 | 90 | 80 | Known services $Message$ terminated by a potential ransomware on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
index f351346665..b3fed5907a 100644
--- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
+++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
@@ -90,6 +90,8 @@ Administrators, administrative actions or certain applications may run many inst
 | 56.0 | 80 | 70 | An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
index 568d814110..2c53d899b3 100644
--- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
+++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
@@ -96,6 +96,8 @@ Limited false positives. Filter as needed.
 | 48.0 | 60 | 80 | A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
index 46337ba380..695de3dba9 100644
--- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
+++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
@@ -96,6 +96,8 @@ False positives should be limited. Filter as needed.
 | 56.0 | 70 | 80 | A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
index 3d7a47d2a4..0a0fd13466 100644
--- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
+++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
@@ -90,6 +90,8 @@ False positives may only pertain to it not being related to Empire, but another
 | 81.0 | 90 | 90 | The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
index 5489a15211..8cc908c6cc 100644
--- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
+++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
@@ -86,6 +86,8 @@ False positives should be limited as the commands being identifies are quite spe
 | 90.0 | 90 | 100 | The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
index 7ef9b9e832..bafcdd5b5a 100644
--- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
+++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
@@ -86,6 +86,8 @@ Potential for some third party applications to disable AMSI upon invocation. Fil
 | 49.0 | 70 | 70 | Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
index 5e47c3b203..f7c233a19d 100644
--- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
+++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
@@ -96,6 +96,8 @@ administrator may execute this app to manage disk
 | 90.0 | 100 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
index 46d74a004c..9ba31ccdc3 100644
--- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
+++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
@@ -93,6 +93,8 @@ network operator may disable audit event logs for debugging purposes.
 | 24.0 | 30 | 80 | WevtUtil.exe used to disable Event Logging on $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
index 4eabb47cd2..23c0b948e7 100644
--- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
+++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
@@ -89,6 +89,8 @@ takeown.exe is a normal windows application that may used by network operator.
 | 56.0 | 70 | 80 | A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
index cd31a84c93..54b524c81c 100644
--- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
+++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
@@ -87,6 +87,8 @@ powershell developer may used this function in their script for instance checkin
 | 40.0 | 50 | 80 | A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md
index 334d3e75cf..549c86e31d 100644
--- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md
+++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md
@@ -88,6 +88,8 @@ It is possible there will be false positives, filter as needed.
 | 42.0 | 60 | 70 | A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md
index 7eb39b4055..6e6496fc80 100644
--- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md
+++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md
@@ -90,6 +90,8 @@ False positives should be limited as day to day scripts do not use this method.
 | 56.0 | 70 | 80 | A suspicious powershell script contains reflective class assembly  command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
index e96b448091..3ddd554733 100644
--- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
+++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
@@ -88,6 +88,8 @@ powershell may used this function to process compressed data.
 | 40.0 | 50 | 80 | A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
index 5eb7f0dd2c..8f83bb0ddd 100644
--- a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
+++ b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
@@ -83,6 +83,8 @@ powershell may used this function to store out object into memory.
 | 40.0 | 50 | 80 | A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
index 94f83aaf72..255a8f6b35 100644
--- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
+++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
@@ -89,6 +89,8 @@ Administrators may modify the boot configuration ignore failure during testing a
 | 56.0 | 70 | 80 | A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
index 0b5a793fd5..81a0d8d5bc 100644
--- a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
+++ b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
@@ -84,6 +84,8 @@ network administrator may used this command for checking purposes
 | 56.0 | 70 | 80 | A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md
index 21b7da7740..5690b9ad1f 100644
--- a/docs/_posts/2021-06-10-recon_using_wmi_class.md
+++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md
@@ -83,6 +83,8 @@ network administrator may used this command for checking purposes
 | 60.0 | 75 | 80 | A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
index 4d52e52040..7c5d2b675f 100644
--- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
+++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
@@ -83,6 +83,8 @@ network administrator may used this command for checking purposes
 | 30.0 | 30 | 100 | Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md b/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md
index d9d9b7054f..ac0a37a013 100644
--- a/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md
+++ b/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md
@@ -91,6 +91,8 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ
 | 63.0 | 70 | 90 | A wevtutil process $process_name$ with commandline $cmd_line$ to clear event logs in host $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md b/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md
index 79213df4b7..908ec247b7 100644
--- a/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md
+++ b/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md
@@ -90,6 +90,8 @@ network operator may disable audit event logs for debugging purposes.
 | 63.0 | 70 | 90 | A wevtutil process $process_name$ with commandline $cmd_line$ to disable event logs in host $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
index 5d825321fb..f9da351d22 100644
--- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
+++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
@@ -93,6 +93,8 @@ It is possible some applications will create a consumer and may be required to b
 | 63.0 | 70 | 90 | Possible malicious WMI Subscription created on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
index a13cfc3a1b..805acf7082 100644
--- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
+++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
@@ -87,6 +87,8 @@ It is possible the Event Logging service gets shut down due to system errors or
 | 9.0 | 30 | 30 | The Windows Event Log Service shutdown on $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
index 8fc395861a..d236afcf2f 100644
--- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
+++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
@@ -92,6 +92,8 @@ unknown
 | 56.0 | 80 | 70 | Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
index 569ddd6cbc..119e29a6f6 100644
--- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
+++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
@@ -83,6 +83,8 @@ network operator may enable or disable this windows feature.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
index b1f725b807..6d68aa0244 100644
--- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
+++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
@@ -91,6 +91,8 @@ network operator may use this batch command to delete recursively a directory or
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
index 6b8b382676..fbac458768 100644
--- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
@@ -91,6 +91,8 @@ network admin may modify this firewall feature that may cause this rule to be tr
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
index fac070cd18..01fd7fa0f4 100644
--- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
@@ -92,6 +92,8 @@ network admin may modify this firewall feature that may cause this rule to be tr
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
index 77d8807714..fdc2f0ded4 100644
--- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
+++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
@@ -86,6 +86,8 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
index 11b2d9b243..94cf2a5f87 100644
--- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
+++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
@@ -93,6 +93,8 @@ Legitimate programs and administrators will execute sc.exe with the start disabl
 | 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
index b2e1101642..2315e1b8c7 100644
--- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
+++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
@@ -94,6 +94,8 @@ Unknown. This may require filtering.
 | 72.0 | 80 | 90 | Suspicious print driver was loaded on endpoint $ComputerName$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
index 53ccf0ee6d..23f91b514b 100644
--- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
+++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
@@ -95,6 +95,8 @@ False positives are unknown and filtering may be required.
 | 72.0 | 80 | 90 | Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
index bf4ab7015b..bbe31b19cd 100644
--- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
+++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
@@ -100,6 +100,8 @@ Limited false positives have been identified. There are limited instances where
 | 72.0 | 80 | 90 | $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
index 430cec0a0c..15d5421041 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
@@ -92,6 +92,8 @@ unknown
 | 72.0 | 80 | 90 | $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
index 1cd3fe8f83..4b4395f9ca 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
@@ -86,6 +86,8 @@ Unknown. Filter as needed.
 | 72.0 | 80 | 90 | $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
index fb89aafcde..67347664e8 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
@@ -99,6 +99,8 @@ Unknown.
 | 72.0 | 80 | 90 | $process_name$ has been identified writing dll&#39;s to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
index 8170d12dbf..9f5195caee 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
@@ -93,6 +93,8 @@ Limited false positives. Filter as needed.
 | 72.0 | 80 | 90 | $process_name$ has been identified writing dll&#39;s to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
index 11ed468fdc..78f276378c 100644
--- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
+++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
@@ -89,6 +89,8 @@ quite minimal false positive expected.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
index 46a1b16609..e9706d7112 100644
--- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
+++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
@@ -92,6 +92,8 @@ Limited false positives. However, tune based on scripts that may perform this ac
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-12-net_profiler_uac_bypass.md b/docs/_posts/2021-07-12-net_profiler_uac_bypass.md
index 5152615424..3bd0cb1643 100644
--- a/docs/_posts/2021-07-12-net_profiler_uac_bypass.md
+++ b/docs/_posts/2021-07-12-net_profiler_uac_bypass.md
@@ -91,6 +91,8 @@ limited false positive. It may trigger by some windows update that will modify t
 | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
index b7757ae4cd..e9d1f804a4 100644
--- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
+++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
@@ -94,6 +94,8 @@ unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
 | 63.0 | 70 | 90 | Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ with EventCode $EventCode$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
index 7d1b88b003..194840ecde 100644
--- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
+++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
@@ -105,6 +105,8 @@ It&#39;s possible that a user will start to create compute instances for the fir
 | 18.0 | 30 | 60 | User $user$ is creating a new instance $dest$ for the first time |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-19-aws_createaccesskey.md b/docs/_posts/2021-07-19-aws_createaccesskey.md
index 862fbaf211..44f1ca20d7 100644
--- a/docs/_posts/2021-07-19-aws_createaccesskey.md
+++ b/docs/_posts/2021-07-19-aws_createaccesskey.md
@@ -89,6 +89,8 @@ While this search has no known false positives, it is possible that an AWS admin
 | 63.0 | 70 | 90 | User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md
index d48f8143ce..40e193bd7d 100644
--- a/docs/_posts/2021-07-19-aws_createloginprofile.md
+++ b/docs/_posts/2021-07-19-aws_createloginprofile.md
@@ -93,6 +93,8 @@ While this search has no known false positives, it is possible that an AWS admin
 | 72.0 | 90 | 80 | User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-19-aws_updateloginprofile.md b/docs/_posts/2021-07-19-aws_updateloginprofile.md
index b5ccdd8908..979d3810dc 100644
--- a/docs/_posts/2021-07-19-aws_updateloginprofile.md
+++ b/docs/_posts/2021-07-19-aws_updateloginprofile.md
@@ -89,6 +89,8 @@ While this search has no known false positives, it is possible that an AWS admin
 | 30.0 | 50 | 60 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
index b2f235ea1b..2fe745f183 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
@@ -97,6 +97,8 @@ While this search has no known false positives, it is possible that an AWS admin
 | 48.0 | 60 | 80 | User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
index d9caebbd8a..7a9afa0ef8 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
@@ -93,6 +93,8 @@ While this search has no known false positives, it is possible that an AWS admin
 | 48.0 | 60 | 80 | User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
index 71f939d4e3..95bfaaa617 100644
--- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
+++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
@@ -99,6 +99,8 @@ limitted. this anomaly behavior is not commonly seen in clean host.
 | 56.0 | 70 | 80 | a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
index aba4219e77..795478bfdb 100644
--- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
+++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
@@ -97,6 +97,8 @@ IT or network admin may create an document automation that will run shell script
 | 56.0 | 70 | 80 | an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
index 7613b11d71..5b7a56a807 100644
--- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
+++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
@@ -89,6 +89,8 @@ It is possible that an AWS admin has legitimately shared a snapshot with others
 | 48.0 | 60 | 80 | AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
index 51fdd631af..081a8e2250 100644
--- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
+++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
@@ -91,6 +91,8 @@ Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hive
 | 80.0 | 80 | 100 | PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
index a4ad539c81..e5217eb727 100644
--- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
+++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
@@ -86,6 +86,8 @@ Natively, `dllhost.exe` will access the files. Every environment will have addit
 | 80.0 | 80 | 100 | The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
index 1ac00fea96..ed1b4cc266 100644
--- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
+++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
@@ -88,6 +88,8 @@ unknown
 | 70.0 | 70 | 100 | rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-26-rundll32_dnsquery.md b/docs/_posts/2021-07-26-rundll32_dnsquery.md
index bfee752058..1181587c90 100644
--- a/docs/_posts/2021-07-26-rundll32_dnsquery.md
+++ b/docs/_posts/2021-07-26-rundll32_dnsquery.md
@@ -90,6 +90,8 @@ unknown
 | 56.0 | 70 | 80 | rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
index e07ef82bcb..da6073a45d 100644
--- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
+++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
@@ -89,6 +89,8 @@ unknown
 | 80.0 | 80 | 100 | rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
index d700ef8ebf..a4fe383fc7 100644
--- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
+++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
@@ -97,6 +97,8 @@ limitted. this parameter is not commonly used by windows application but can be
 | 56.0 | 70 | 80 | rundll32 process $process_name$ with commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
index 0100e04011..c48c73668b 100644
--- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
+++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
@@ -97,6 +97,8 @@ third party application may used this dll export name to execute function.
 | 42.0 | 60 | 70 | rundll32 process $process_name$ with commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md
index 63e0565539..adf0957603 100644
--- a/docs/_posts/2021-07-27-chcp_command_execution.md
+++ b/docs/_posts/2021-07-27-chcp_command_execution.md
@@ -89,6 +89,8 @@ other tools or script may used this to change code page to UTF-* or others
 | 9.0 | 30 | 30 | parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
index 2833a0dcdc..e0f2084b47 100644
--- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
+++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
@@ -101,6 +101,8 @@ minimal. but network operator can use this application to load dll.
 | 56.0 | 70 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
index 5d1269a72b..a45dc70dea 100644
--- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
+++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
@@ -88,6 +88,8 @@ unknown
 | 56.0 | 70 | 80 | rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
index d0cafd705b..4179feddc6 100644
--- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md
+++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
@@ -84,6 +84,8 @@ unknown
 | 63.0 | 70 | 90 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
index 4ff251d2f7..1d73297a56 100644
--- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
+++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
@@ -89,6 +89,8 @@ unknown
 | 72.0 | 80 | 90 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
index 659d516f84..953cb6e2eb 100644
--- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
+++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
@@ -97,6 +97,8 @@ unknown
 | 63.0 | 70 | 90 | Office application spawning regsvr32.exe on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
index 6bec47116e..8a738ccbc3 100644
--- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
+++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
@@ -85,6 +85,8 @@ unknown
 | 9.0 | 30 | 30 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
index b31658f923..b287fffbf3 100644
--- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
+++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
@@ -88,6 +88,8 @@ unknown
 | 70.0 | 70 | 100 | process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
index 522faeeb2d..71c4261315 100644
--- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
+++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
@@ -93,6 +93,8 @@ unknown.
 | 30.0 | 50 | 60 | process $process_name$ with a cmdline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-10-powershell_execute_com_object.md b/docs/_posts/2021-08-10-powershell_execute_com_object.md
index 23d378ab9e..c99d3d9e87 100644
--- a/docs/_posts/2021-08-10-powershell_execute_com_object.md
+++ b/docs/_posts/2021-08-10-powershell_execute_com_object.md
@@ -87,6 +87,8 @@ network operrator may use this command.
 | 5.0 | 10 | 50 | A suspicious powershell script contains COM CLSID command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
index a17491c0a5..7f5af18908 100644
--- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md
+++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
@@ -87,6 +87,8 @@ unknown
 | 54.0 | 60 | 90 | Possible file data deletion on $dest$ using $process$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
index 2bfa6c6f8b..0d83ccf517 100644
--- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
+++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
@@ -91,6 +91,8 @@ not so common. but 3rd part app may load this dll.
 | 48.0 | 60 | 80 | The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
index 5a44e5978c..d0c3dda7c1 100644
--- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
+++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
@@ -97,6 +97,8 @@ network admin or normal user may share files to customer and external team.
 | 72.0 | 80 | 90 | suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
index afee5a519f..46e118a824 100644
--- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
+++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
@@ -94,6 +94,8 @@ network admin and normal user may send this file attachment as part of their day
 | 49.0 | 70 | 70 | suspicious email from $source.address$ to $destination{}.address$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
index dcd885c546..08ccd93946 100644
--- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
+++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
@@ -93,6 +93,8 @@ unknown
 | 25.0 | 50 | 50 | archive process $process_name$ with suspicious cmdline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
index 334c6b56ee..c71264bb1f 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
@@ -100,6 +100,8 @@ unknown
 | 70.0 | 70 | 100 | Vulnerabilities with severity high found in image $image$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
index b2c980d11f..90e965f033 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
@@ -100,6 +100,8 @@ unknown
 | 7.0 | 10 | 70 | Vulnerabilities with severity high found in repository $repositoryName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
index 47d4bd1059..3734e2b974 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
@@ -100,6 +100,8 @@ unknown
 | 21.0 | 30 | 70 | Vulnerabilities with severity high found in image $image$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
index dc16a20838..5d68ed25cb 100644
--- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
+++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
@@ -91,6 +91,8 @@ network admin and normal user may send this file attachment as part of their day
 | 9.0 | 30 | 30 | suspicious email from $source.address$ to $destination{}.address$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md
index 3cfadcc403..a51616375c 100644
--- a/docs/_posts/2021-08-18-esentutl_sam_copy.md
+++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md
@@ -98,6 +98,8 @@ False positives should be limited. Filter as needed.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to capture credentials for offline cracking or observability. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md
index d9a5c16157..a2090ba416 100644
--- a/docs/_posts/2021-08-18-powershell_4104_hunting.md
+++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md
@@ -257,6 +257,8 @@ Limited false positives. May filter as needed.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing suspicious commands. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
index 8c3389366b..311931c0c7 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
@@ -96,6 +96,8 @@ When your development is spreaded in different time zones, applying this rule ca
 | 49.0 | 70 | 70 | Container uploaded outside business hours from $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
index 56f58d649c..80759e0adc 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
@@ -97,6 +97,8 @@ unknown
 | 49.0 | 70 | 70 | Container uploaded from unknown user $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
index 32a1341f7f..4d05aae845 100644
--- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
+++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
@@ -83,6 +83,8 @@ normal user or normal transaction may contain the subject and file type attachme
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
index ca22152540..f624197c95 100644
--- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
+++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
@@ -75,6 +75,8 @@ Some networks may use kerberized FTP or telnet servers, however, this is rare.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
index 8274787cf1..5939a739d2 100644
--- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md
+++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
@@ -83,6 +83,8 @@ admin can do changes directly to master branch
 | 9.0 | 30 | 30 | suspicious commit by $commit.commit.author.email$ to main branch |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
index e7338ae6a5..3d6a15c034 100644
--- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
+++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
@@ -92,6 +92,8 @@ unknown
 | 49.0 | 70 | 70 | Local File Inclusion Attack detected on $host$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
index 6caea2987f..5a709ec9cb 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
@@ -85,6 +85,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
index 24ce365ed1..8bf13b7bf4 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
@@ -82,6 +82,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
index 5fa7a10b5b..3ee50b9d02 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
@@ -85,6 +85,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
index 3a824e441e..c9a6f0ad85 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
@@ -82,6 +82,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
index d47522863c..234e51385f 100644
--- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
+++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
@@ -83,6 +83,8 @@ normal email contains this link that are known application within the organizati
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
index b9967305d7..2ea358d35c 100644
--- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
+++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
@@ -97,6 +97,8 @@ normal user or normal transaction may contain the subject and file type attachme
 | 21.0 | 30 | 70 | suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
index cb2534cf91..d867ce7fdf 100644
--- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
+++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
@@ -87,6 +87,8 @@ unknown
 | 49.0 | 70 | 70 | Remote File Inclusion Attack detected on $host$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
index 0220668c50..c647310767 100644
--- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
+++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
@@ -87,6 +87,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
index 1ced833dc0..64b17ddb4e 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
@@ -93,6 +93,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
index ce1b122f58..670eea9bd8 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
@@ -94,6 +94,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
index e74b409fa5..d88b40119a 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
@@ -93,6 +93,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
index dbe69057fa..6fd459041b 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
@@ -92,6 +92,8 @@ Limited false positives as this requires an active Administrator or adversary to
 | 12.0 | 30 | 40 | Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
index 91e4bf8798..b678040a32 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
@@ -87,6 +87,8 @@ It is possible certain system management frameworks utilize this command to gath
 | 12.0 | 30 | 40 | Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
index 002fb470d8..38c81abc56 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
@@ -93,6 +93,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
index 2f23d66fc2..3863094d15 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
@@ -87,6 +87,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
index a77d223086..0fce4f455b 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
@@ -93,6 +93,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
index 46ab159e26..018bbcca06 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
@@ -87,6 +87,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
index e4493b0f9b..5d8cbfffd1 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
@@ -93,6 +93,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
index aae67add03..1a7ad97d66 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
@@ -87,6 +87,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
index 8aa14886e6..7030f6f31a 100644
--- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
+++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
@@ -91,6 +91,8 @@ unknown
 | 81.0 | 90 | 90 | Kubernetes Scanner image pulled on host $host$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
index 9662fc873f..127f2d4a26 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
@@ -86,6 +86,8 @@ Administrators or power users may use Adsisearcher for troubleshooting.
 | 18.0 | 30 | 60 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
index 2206509b90..e0521d1c60 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
@@ -95,6 +95,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
index c04b837758..e8a4231b57 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
@@ -95,6 +95,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
index e1f29da27c..a33aabc871 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
@@ -95,6 +95,8 @@ Administrators or power users may use this command for troubleshooting.
 | 21.0 | 30 | 70 | Elevated domain group discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
index 224c7c81cf..27316125e0 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
@@ -86,6 +86,8 @@ Administrators or power users may use this PowerView for troubleshooting.
 | 21.0 | 30 | 70 | Elevated group discovery using PowerView on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
index b3600fc1a2..b02f6a2edc 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
@@ -95,6 +95,8 @@ Administrators or power users may use this command for troubleshooting.
 | 21.0 | 30 | 70 | Elevated domain group discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
index 3f20aaac21..04189e415d 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
@@ -95,6 +95,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
index 52c911191b..d5fb9e7081 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
@@ -86,6 +86,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
index 5ad581318f..a6b52bd6ef 100644
--- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
@@ -95,6 +95,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Domain group discovery with PowerView on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
index ed741820e3..deb4ecd7b7 100644
--- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
+++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
index 303544f962..b392b27e54 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
@@ -95,6 +95,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
index bff9af74a4..0e6aa72098 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
@@ -86,6 +86,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
index c561c75827..7f778d80e7 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
@@ -89,6 +89,8 @@ Administrators or power users may use this command for troubleshooting.
 | 9.0 | 30 | 30 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
index 4896efdf6e..2bdb60818a 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
@@ -83,6 +83,8 @@ Administrators or power users may use this command for troubleshooting.
 | 9.0 | 30 | 30 | powershell process having commandline $Message$ to query domain password policy |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
index 75a973821b..09f7a7626b 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
@@ -89,6 +89,8 @@ Administrators or power users may use this command for troubleshooting.
 | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
index ddd7c2ab64..b645bc2992 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
@@ -83,6 +83,8 @@ Administrators or power users may use this command for troubleshooting.
 | 9.0 | 30 | 30 | powershell process having commandline $Message$ to query domain user password policy. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
index 14ebee4b0c..dd15fd6ac7 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
@@ -89,6 +89,8 @@ Administrators or power users may use this command for troubleshooting.
 | 30.0 | 50 | 60 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
index d0232abe6a..5481d2ab36 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
@@ -83,6 +83,8 @@ Administrators or power users may use this command for troubleshooting.
 | 30.0 | 50 | 60 | powershell process having commandline $Message$ to query domain policy. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
index c2e3a8ba80..6b9495e9fd 100644
--- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
@@ -86,6 +86,8 @@ Administrators or power users may use this PowerView functions for troubleshooti
 | 15.0 | 30 | 50 | Domain group discovery enumeration using PowerView on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
index e68f7fecf5..e437824df6 100644
--- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
+++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
@@ -89,6 +89,8 @@ Administrators or power users may use this command for troubleshooting.
 | 9.0 | 30 | 30 | an instance of process $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
index a101c585c9..c0839aab80 100644
--- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
+++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
@@ -100,6 +100,8 @@ This detection should yield little or no false positive results. It is uncommon
 | 63.0 | 70 | 90 | A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
index 4e8434ac4c..943785b6be 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
@@ -90,6 +90,8 @@ Limited false positives, however, tune as needed.
 | 80.0 | 80 | 100 | Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
index 4b93056cbc..3cd1f2c919 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
@@ -95,6 +95,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
index f9387c85ff..847eff86d3 100644
--- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
+++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 21.0 | 30 | 70 | Domain controller discovery on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
index df1017057f..8848308f9b 100644
--- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
+++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
index 53f8824225..799420ec7f 100644
--- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
@@ -90,6 +90,8 @@ False positives have been limited when the Anonymous Logon is used for Account N
 | 56.0 | 80 | 70 | A remote host is enumerating a $dest$ to identify permissions. This is a precursor event to CVE-2021-36942, PetitPotam. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
index b937fe2768..3f078d4371 100644
--- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
@@ -86,6 +86,8 @@ False positives are possible if the environment is using certificates for authen
 | 56.0 | 80 | 70 | A Kerberos TGT was requested in a non-standard manner against $dest$, potentially related to CVE-2021-36942, PetitPotam. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
index 92cfbe683b..096780eb42 100644
--- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
index 7f7ef5a6dd..30fe4ad121 100644
--- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
+++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
@@ -96,6 +96,8 @@ unknown
 | 72.0 | 80 | 90 | disable security step $mandatory_step$ in job $job_name$ from user $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
index 259e79412f..43a2a3fbdd 100644
--- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 21.0 | 30 | 70 | Domain controller discovery on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
index bfd16b610e..0e2e1c35a5 100644
--- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
+++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
@@ -95,6 +95,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
index 6bc415ea6a..09dd3c424b 100644
--- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
@@ -82,6 +82,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
index 8edd5f6626..4aa3b5b543 100644
--- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
@@ -82,6 +82,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md
index 03e23b4378..7351856da8 100644
--- a/docs/_posts/2021-09-01-github_commit_in_develop.md
+++ b/docs/_posts/2021-09-01-github_commit_in_develop.md
@@ -81,6 +81,8 @@ admin can do changes directly to develop branch
 | 9.0 | 30 | 30 | suspicious commit by $commit.commit.author.email$ to develop branch |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md
index ff70459260..f4873d8edd 100644
--- a/docs/_posts/2021-09-01-github_dependabot_alert.md
+++ b/docs/_posts/2021-09-01-github_dependabot_alert.md
@@ -97,6 +97,8 @@ unknown
 | 27.0 | 30 | 90 | Vulnerabilities found in packages used by GitHub repository $repository$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
index bda5a57f46..5e4f9ed1fb 100644
--- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
+++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
@@ -99,6 +99,8 @@ unknown
 | 27.0 | 30 | 90 | Vulnerabilities found in packages used by GitHub repository $repository$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
index 1e1b6078f7..5a2653dfe6 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
@@ -82,6 +82,8 @@ Administrators or power users may use Adsisearcher for troubleshooting.
 | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
index 85f2ed6cf3..1c7ce46ed1 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
index 3cd5f359d5..8917082d82 100644
--- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
+++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
@@ -92,6 +92,8 @@ unknown
 | 72.0 | 80 | 90 | disable security job $mandatory_job$ in workflow $workflow_name$ from user $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
index 6135d3ff85..52fe1267b0 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
@@ -92,6 +92,8 @@ Limited false positives as this requires an active Administrator or adversary to
 | 12.0 | 30 | 40 | Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
index 8798939929..84729f94c0 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
@@ -87,6 +87,8 @@ UPDATE_KNOWN_FALSE_POSITIVES
 | 12.0 | 30 | 40 | Suspicious PowerShell Get-ForestTrust was identified on endpoint $ComputerName$ by user $User$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
index a9165718c1..7ab2ec6a6d 100644
--- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
@@ -82,6 +82,8 @@ Administrators or power users may use PowerView for troubleshooting.
 | 24.0 | 30 | 80 | Remote system discovery with PowerView on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
index 0d005a322b..12b721e8bb 100644
--- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
@@ -82,6 +82,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 24.0 | 30 | 80 | Remote system discovery with PowerView on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
index ee252b0c51..ad7530a633 100644
--- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
+++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
@@ -87,6 +87,8 @@ unknown
 | 35.0 | 50 | 70 | bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
index b2da8e3ec8..1764a1ae59 100644
--- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
+++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
@@ -87,6 +87,8 @@ unknown
 | 25.0 | 50 | 50 | bcdedit process with commandline $process$ to force safemode boot the $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
index 13d47cb2a5..6838aea9e7 100644
--- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
+++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
@@ -84,6 +84,8 @@ unknown
 | 70.0 | 70 | 100 | Correlation triggered for user $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
index 771bb4ebde..aabf2dbbf9 100644
--- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
+++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
@@ -84,6 +84,8 @@ unknown
 | 70.0 | 70 | 100 | Correlation triggered for user $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
index 7e27aff516..b33a1501d3 100644
--- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
index a32b2e7a26..49ba2384b0 100644
--- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
@@ -91,6 +91,8 @@ Administrators or power users may use PowerView for troubleshooting.
 | 24.0 | 30 | 80 | Remote system discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
index 416331b3f4..42d6fc980d 100644
--- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
@@ -91,6 +91,8 @@ Administrators or power users may use PowerView for troubleshooting.
 | 24.0 | 30 | 80 | Remote system discovery using PowerView on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
index 99cb172d6b..67e00af893 100644
--- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 21.0 | 30 | 70 | Remote system discovery enumeration using WMI on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
index 1f92babcdc..1772cb517c 100644
--- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
+++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
@@ -90,6 +90,8 @@ normal application like mmc.exe and other ldap query tool may trigger this detec
 | 25.0 | 50 | 50 | process $Image$ create a file $TargetFilename$ in host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md
index 6a1bd255d9..a6c3b1e7d8 100644
--- a/docs/_posts/2021-09-07-system_information_discovery_detection.md
+++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md
@@ -88,6 +88,8 @@ Administrators debugging servers
 | 15.0 | 30 | 50 | Potential system information discovery behavior on $dest$ by $User$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
index 67dfdc58bb..2ddd90b4d4 100644
--- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
@@ -96,6 +96,8 @@ Limited false positives will be present as control.exe does not natively load fr
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
index 3002f491e0..8fd0c88530 100644
--- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
+++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
@@ -96,6 +96,8 @@ Administrators often leverage net.exe to create admin accounts.
 | 30.0 | 50 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md
index 6a511dbd24..ce86e6cfd2 100644
--- a/docs/_posts/2021-09-08-office_spawning_control.md
+++ b/docs/_posts/2021-09-08-office_spawning_control.md
@@ -97,6 +97,8 @@ Limited false positives should be present.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
index ec16b24478..936ae7674c 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
@@ -98,6 +98,8 @@ This is a hunting detection, meant to provide a understanding of how voluminous
 | 15.0 | 30 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
index 93be658e45..aa6861016c 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
@@ -98,6 +98,8 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
index 7d4cc63a1a..5a973f0015 100644
--- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md
+++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
@@ -98,6 +98,8 @@ It is possible some agent based products will generate false positives. Filter a
 | 56.0 | 80 | 70 | Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
index d30f437095..8a0c141d71 100644
--- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
+++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
@@ -92,6 +92,8 @@ Limited false positives will be present, however, tune as necessary.
 | 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
index f07d0277af..4a74b6b373 100644
--- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
@@ -82,6 +82,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
index 4b635f489b..e39985d88d 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
index 02d79dedbd..96dc60f099 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
index bd0baab169..e624431581 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
@@ -91,6 +91,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
index 8ecb1f8709..46c8ff94eb 100644
--- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
+++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
@@ -96,6 +96,8 @@ The query is structured in a way that `action` (read, create) is not defined. Re
 | 80.0 | 80 | 100 | An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
index 59766fa456..5c823d0e81 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
@@ -92,6 +92,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | System user discovery on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
index 758d4468e1..5012ebfff5 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
@@ -84,6 +84,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | System user discovery on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
index 16b0dd71bf..8cb5e199aa 100644
--- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
+++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
@@ -93,6 +93,8 @@ unknown
 | 49.0 | 70 | 70 | Process name $process_name$ with commandline $process$ to execute jscript in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
index d2492ef8c7..be3f442364 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
@@ -91,6 +91,8 @@ automation scripting language may used by network operator to do ldap query.
 | 9.0 | 30 | 30 | $process_name$ loading ldap modules $ImageLoaded$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
index 6d4db48668..1152dea23c 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
@@ -91,6 +91,8 @@ automation scripting language may used by network operator to do ldap query.
 | 9.0 | 30 | 30 | $process_name$ loading wmi modules $ImageLoaded$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md
index e3fa4b0c50..f24d709974 100644
--- a/docs/_posts/2021-09-13-office_application_drop_executable.md
+++ b/docs/_posts/2021-09-13-office_application_drop_executable.md
@@ -95,6 +95,8 @@ office macro for automation may do this behavior
 | 64.0 | 80 | 80 | process $process_name$ drops a file $TargetFilename$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
index 96b5696496..81323a5aae 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
@@ -92,6 +92,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | System user discovery on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
index 68eddc60c9..86e4c88f94 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
@@ -92,6 +92,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | System user discovery on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
index ea24003b1f..7910d1b0a7 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
@@ -92,6 +92,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | System user discovery on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
index f7ec2bd4c4..bf04a57381 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
@@ -84,6 +84,8 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 | 15.0 | 30 | 50 | System user discovery on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
index fbed846186..b789752ec5 100644
--- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
+++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
@@ -90,6 +90,8 @@ unknown
 | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
index 02641b1c44..156be47415 100644
--- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
+++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
@@ -96,6 +96,8 @@ A network operator or systems administrator may utilize an automated host discov
 | 56.0 | 70 | 80 | A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
index 235a750595..9fceb935a2 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
@@ -96,6 +96,8 @@ False positives may be present. Tune as needed.
 | 15.0 | 30 | 50 | System group discovery on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
index f0c96898df..7087f2751c 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
@@ -89,6 +89,8 @@ False positives may be present. Tune as needed.
 | 15.0 | 30 | 50 | System group discovery enumeration on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md
index 9e9a107b61..07f6a05b92 100644
--- a/docs/_posts/2021-09-14-net_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md
@@ -97,6 +97,8 @@ False positives may be present. Tune as needed.
 | 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
index 9b38d568ab..cdd0f07d15 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
@@ -96,6 +96,8 @@ False positives may be present. Tune as needed.
 | 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
index fe31bcdbd5..a80fcddcc9 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
@@ -89,6 +89,8 @@ False positives may be present. Tune as needed.
 | 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md
index 30b06ee6b9..e2888cceb1 100644
--- a/docs/_posts/2021-09-14-wmic_group_discovery.md
+++ b/docs/_posts/2021-09-14-wmic_group_discovery.md
@@ -98,6 +98,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
index a635f0d9c4..929db9d421 100644
--- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
+++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
@@ -88,6 +88,8 @@ unknown
 | 56.0 | 70 | 80 | Process name $process_name$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
index dbd889a9a4..e6c7b04f01 100644
--- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
+++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
@@ -94,6 +94,8 @@ other browser not listed related to firefox may catch by this rule.
 | 35.0 | 50 | 70 | a non firefox browser process $process_name$ accessing $Object_Name$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
index f4f126f606..74b0f6d6a9 100644
--- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
+++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
@@ -94,6 +94,8 @@ other browser not listed related to firefox may catch by this rule.
 | 35.0 | 50 | 70 | a non firefox browser process $process_name$ accessing $Object_Name$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
index 7a6234c0e6..46c6cd04fd 100644
--- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md
+++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
@@ -99,6 +99,8 @@ admin or power user may used this series of command.
 | 5.0 | 10 | 50 | Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
index 2cf72cb01b..cf214b666e 100644
--- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
+++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
@@ -95,6 +95,8 @@ There may be legitimate reasons for administrators to add a certificate to the u
 | 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
index 5e802077d3..a0a9c637f9 100644
--- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -99,6 +99,8 @@ None identified.
 | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md
index 8bf9262b91..bcb1906175 100644
--- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md
+++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md
@@ -95,6 +95,8 @@ It is possible for this search to generate a notable event for a batch file writ
 | 63.0 | 70 | 90 | A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md
index d713f8f681..7135294f6f 100644
--- a/docs/_posts/2021-09-16-bits_job_persistence.md
+++ b/docs/_posts/2021-09-16-bits_job_persistence.md
@@ -94,6 +94,8 @@ Limited false positives will be present. Typically, applications will use `BitsA
 | 56.0 | 70 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md
index 7196219fbc..3685064373 100644
--- a/docs/_posts/2021-09-16-bitsadmin_download_file.md
+++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md
@@ -100,6 +100,8 @@ Limited false positives, however it may be required to filter based on parent pr
 | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
index 6d4d072e22..27c066e6a1 100644
--- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
+++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
@@ -98,6 +98,8 @@ Legtimate administrator usage of wmic to create a shadow copy.
 | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
index 974ee7205c..d4ee075672 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
@@ -97,6 +97,8 @@ unknown
 | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
index abd91061a1..1d0943cd3d 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
@@ -97,6 +97,8 @@ unknown
 | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_html_help_renamed.md b/docs/_posts/2021-09-16-detect_html_help_renamed.md
index af28233868..6780747255 100644
--- a/docs/_posts/2021-09-16-detect_html_help_renamed.md
+++ b/docs/_posts/2021-09-16-detect_html_help_renamed.md
@@ -97,6 +97,8 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter
 | 80.0 | 80 | 100 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
index ac090719d8..032d1a6a5a 100644
--- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
@@ -97,6 +97,8 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil
 | 90.0 | 90 | 100 | An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
index a6f85b6f82..91f1717859 100644
--- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
+++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
@@ -97,6 +97,8 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does
 | 72.0 | 80 | 90 | $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
index 708d1b49e6..56bc87a09f 100644
--- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
+++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
@@ -97,6 +97,8 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg
 | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_mshta_renamed.md b/docs/_posts/2021-09-16-detect_mshta_renamed.md
index b196f3b186..ca21ca2717 100644
--- a/docs/_posts/2021-09-16-detect_mshta_renamed.md
+++ b/docs/_posts/2021-09-16-detect_mshta_renamed.md
@@ -97,6 +97,8 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex
 | 80.0 | 80 | 100 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
index 29dd4b45c9..f5657de256 100644
--- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
@@ -97,6 +97,8 @@ It is possible legitimate applications may perform this behavior and will need t
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
index 83b13b29d7..5cc45bb15d 100644
--- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
+++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
@@ -101,6 +101,8 @@ Administrators can leverage PsExec for accessing remote systems and might pass `
 | 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
index 7b44ca80d6..a5e08f0284 100644
--- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md
+++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
@@ -96,6 +96,8 @@ Limited false positives, however this analytic will need to be modified for each
 | 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md
index 459161b747..63bad21aa7 100644
--- a/docs/_posts/2021-09-16-detect_renamed_psexec.md
+++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md
@@ -103,6 +103,8 @@ Limited false positives should be present. It is possible some third party appli
 | 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md
index d8e7711bd8..f5a43ff807 100644
--- a/docs/_posts/2021-09-16-detect_renamed_rclone.md
+++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md
@@ -92,6 +92,8 @@ False positives should be limited as this analytic identifies renamed instances
 | 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md
index baddec447a..e68b64db45 100644
--- a/docs/_posts/2021-09-16-detect_renamed_winrar.md
+++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md
@@ -97,6 +97,8 @@ Unknown. It is possible third party applications use renamed instances of WinRAR
 | 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
index 6017caa1db..201ef1a9bc 100644
--- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
+++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
@@ -95,6 +95,8 @@ None identified.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
index bbe06b79de..b89fd78d8d 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
@@ -86,6 +86,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Local user discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
index c3318139ce..1d3ecad1dc 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
@@ -86,6 +86,8 @@ Administrators or power users may use this command for troubleshooting.
 | 15.0 | 30 | 50 | Local user discovery enumeration on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
index 306a102f5b..39a7aa31a7 100644
--- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md
+++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
@@ -98,6 +98,8 @@ No false positives known. Filter as needed.
 | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md
index 5199390a43..3c2739d0fa 100644
--- a/docs/_posts/2021-09-16-processes_launching_netsh.md
+++ b/docs/_posts/2021-09-16-processes_launching_netsh.md
@@ -94,6 +94,8 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances,
 | 42.0 | 60 | 70 | A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md
index a042c83e58..bff121d182 100644
--- a/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md
@@ -98,6 +98,8 @@ Although unlikely, limited instances of regasm.exe or may cause a false positive
 | 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md
index 4e02e40beb..4b784ba308 100644
--- a/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md
@@ -98,6 +98,8 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive.
 | 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
index f40280c609..4b3403845e 100644
--- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
+++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
@@ -96,6 +96,8 @@ Default browser not in the filter list.
 | 35.0 | 70 | 50 | Office document spawning suspicious child process on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md
index e81b9d9387..252aad0b97 100644
--- a/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md
@@ -95,6 +95,8 @@ Limited false positives may be present in small environments. Tuning may be requ
 | 49.0 | 70 | 70 | Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md
index 714d739582..60a84f8763 100644
--- a/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md
@@ -95,6 +95,8 @@ Limited false positives may be present in small environments. Tuning may be requ
 | 49.0 | 70 | 70 | Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
index 7c754b0624..049ac746c1 100644
--- a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
+++ b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
@@ -103,6 +103,8 @@ Although unlikely, some legitimate applications may use a moved copy of microsof
 | 63.0 | 70 | 90 | Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md
index a0e27de3a3..e461aa4f88 100644
--- a/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md
@@ -101,6 +101,8 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
 | 49.0 | 70 | 70 | Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md
index 8a65c5fdc7..f377cfe138 100644
--- a/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md
@@ -94,6 +94,8 @@ Limited false positives may be present in small environments. Tuning may be requ
 | 49.0 | 70 | 70 | Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
index 9a2ac51a22..d1614dd2d9 100644
--- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
+++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
@@ -85,6 +85,8 @@ unknown
 | 100.0 | 100 | 100 | file $file_name$ created in $file_path$ of $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
index 53336ad314..4983339cc4 100644
--- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
+++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
@@ -89,6 +89,8 @@ unknown
 | 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
index 6b346c1cf3..fffb354cff 100644
--- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
+++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
@@ -89,6 +89,8 @@ unknown
 | 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md
index 865c16553e..2d79910ed4 100644
--- a/docs/_posts/2021-09-27-change_default_file_association.md
+++ b/docs/_posts/2021-09-27-change_default_file_association.md
@@ -93,6 +93,8 @@ unknown
 | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
index 08205164ff..e36a0295a0 100644
--- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
@@ -93,6 +93,8 @@ unknown
 | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
index e7fd1fc309..85153ef7c7 100644
--- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
@@ -93,6 +93,8 @@ unknown
 | 72.0 | 80 | 90 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
index acb99d13c2..113f41dc00 100644
--- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md
+++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
@@ -95,6 +95,8 @@ possible new printer installation may add driver component on this registry.
 | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
index 72d73f496f..5189626b50 100644
--- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md
+++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
@@ -97,6 +97,8 @@ windows can used this application for its normal COM object validation.
 | 25.0 | 50 | 50 | process $process_name$ to execute possible clsid commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
index 74931701d5..aab7338b44 100644
--- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
+++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
@@ -97,6 +97,8 @@ unknown
 | 49.0 | 70 | 70 | Process name $process_name$ with commandline $process$ to execute vbsscript |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
index 7be85976e7..49f30f28c2 100644
--- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
+++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
@@ -92,6 +92,8 @@ False positives should be limited as developers do not spawn MSBuild via a WSH.
 | 49.0 | 70 | 70 | Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
index 625222ba92..b531bb1dd1 100644
--- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
+++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
@@ -100,6 +100,8 @@ Other third part application may used this parameter but not so common in base w
 | 36.0 | 60 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and dllinstall parameter. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md
index 705f8bbeba..1f100eed7b 100644
--- a/docs/_posts/2021-10-05-detect_exchange_web_shell.md
+++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md
@@ -98,6 +98,8 @@ The query is structured in a way that `action` (read, create) is not defined. Re
 | 81.0 | 90 | 90 | A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
index 626f555131..1c63814662 100644
--- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
+++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
@@ -97,6 +97,8 @@ False positives should be limited, filter as needed. In our test case, Remcos us
 | 80.0 | 80 | 100 | The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
index b4961b4bf4..5527bafa73 100644
--- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
+++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
@@ -96,6 +96,8 @@ False positives should be limited, however it is possible to filter by Processes
 | 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
index 17e8040214..abd2b246b9 100644
--- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
+++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
@@ -93,6 +93,8 @@ unknown
 | 80.0 | 80 | 100 | rundll32 process execute $process$ to clear shim cache in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
index 53eb4d47e9..b31f4a0d39 100644
--- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
+++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
@@ -97,6 +97,8 @@ every user may do this event but very un-ussual.
 | 63.0 | 70 | 90 | execution of copy exe to copy file from $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
index 8757d560f1..60bd4906c3 100644
--- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
+++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
@@ -93,6 +93,8 @@ False positives should be limited as winhlp32.exe is typically not used with the
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
index 7a7f8a0542..351b227f6e 100644
--- a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
+++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
@@ -94,6 +94,8 @@ It&#39;s possible there can be long domain names that are legitimate.
 | 56.0 | 70 | 80 | A dns query $query$ with 2 time standard deviation of name len of the dns query in host  $host$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md
index 17dd343fb6..e678dfbd8e 100644
--- a/docs/_posts/2021-10-06-sdelete_application_execution.md
+++ b/docs/_posts/2021-10-06-sdelete_application_execution.md
@@ -101,6 +101,8 @@ user may execute and use this application
 | 49.0 | 70 | 70 | sdelete process $process_name$ executed in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
index fe2da0e523..bce5c13dd7 100644
--- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
+++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
@@ -111,6 +111,8 @@ Administrators may create vbs or js script that use several tool as part of its
 | 49.0 | 70 | 70 | wscript or cscript parent process spawned $process_name$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
index eb1472ba59..1e90eb39bc 100644
--- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
+++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
@@ -92,6 +92,8 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ
 | 28.0 | 40 | 70 | Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md
index ea6306a6ba..151e446b54 100644
--- a/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md
@@ -94,6 +94,8 @@ Although unlikely, some legitimate third party applications may use a moved copy
 | 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md
index fb7c32d9f0..bd535dd110 100644
--- a/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md
@@ -106,6 +106,8 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32
 | 70.0 | 70 | 100 | A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md
index b5725c00b2..6f58db7fae 100644
--- a/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md
+++ b/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md
@@ -93,6 +93,8 @@ Limited false positives may be present in small environments. Tuning may be requ
 | 70.0 | 70 | 100 | A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
index b8057ac435..26fe0825ec 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
@@ -94,6 +94,8 @@ False positives should be limited, however filter as needed.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
index 9ecf2cfc66..511b4ad2ad 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
@@ -100,6 +100,8 @@ False positives may be caused by Administrators resetting SPNs or querying for S
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md
index 0db45ce047..c8d10ab8f4 100644
--- a/docs/_posts/2021-10-18-disable_schedule_task.md
+++ b/docs/_posts/2021-10-18-disable_schedule_task.md
@@ -89,6 +89,8 @@ admin may disable problematic schedule task
 | 56.0 | 70 | 80 | schtask process with commandline $process$ to disable schedule task in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
index 507cb31584..e9f38bd9df 100644
--- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
+++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
@@ -96,6 +96,8 @@ It is possible Administrators or super users will use Curl for legitimate purpos
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
index 2dece601df..ecab753146 100644
--- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
+++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
@@ -89,6 +89,8 @@ False positives will be present. Filter based on ActionName paths or specify key
 | 80.0 | 80 | 100 | A Scheduled Task was scheduled and ran on $dest$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
index 5e9045c2be..7f855e15a7 100644
--- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
+++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
@@ -96,6 +96,8 @@ third party application may use this approach to uninstall there application
 | 25.0 | 50 | 50 | wmic $process$ with commandline $process$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
index 016c224585..4ee95eed34 100644
--- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
+++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
@@ -81,6 +81,8 @@ This is an anomaly search, you must specify your domain in the parameters so it
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
index 2496d39e26..ca23020502 100644
--- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
+++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
@@ -80,6 +80,8 @@ This search will also produce normal activity statistics. Fields such as email,
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md
index 4ed539d0fd..eb973df8e2 100644
--- a/docs/_posts/2021-11-03-windows_adfind_exe.md
+++ b/docs/_posts/2021-11-03-windows_adfind_exe.md
@@ -83,6 +83,8 @@ administrators rarely use adfind, usually not used for legitimate reasons
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
index 7b59d413ea..d2701ad3d8 100644
--- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
+++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
@@ -108,6 +108,8 @@ Some administrator activity can be potentially triggered, please add those users
 | 64.0 | 80 | 80 | An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md b/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
index ad83a31865..4fdff5f2e4 100644
--- a/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
+++ b/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
@@ -98,6 +98,8 @@ Environments in which NTLM is used extremely rarely and for benign purposes (suc
 | 64.0 | 80 | 80 | Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the logging device $origin_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
index c14550658c..a8c7241b23 100644
--- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
+++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
@@ -97,6 +97,8 @@ False positives may be limited to source control applications and may be require
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
index 20e6085c62..49a3198ad0 100644
--- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
@@ -98,6 +98,8 @@ Administrators may create Windows Services on remote systems, but this activity
 | 54.0 | 90 | 60 | A Windows Service was created on a remote endpoint from $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
index 77f9fb15fa..d08314ddc3 100644
--- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
@@ -98,6 +98,8 @@ Administrators may start Windows Services on remote systems, but this activity i
 | 54.0 | 90 | 60 | A Windows Service was started on a remote endpoint from $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
index 965702e860..866953c7a2 100644
--- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
+++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
@@ -96,6 +96,8 @@ Administrators may leverage WinRM and WinRs to start a process on remote systems
 | 54.0 | 90 | 60 | A process was started on a remote endpoint from $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
index 6d651c9df5..2545c8637e 100644
--- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
+++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
@@ -100,6 +100,8 @@ Administrators may create scheduled tasks on remote systems, but this activity i
 | 54.0 | 90 | 60 | A Windows Scheduled Task was created on a remote endpoint from $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
index c934491637..76ab38b644 100644
--- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
@@ -100,6 +100,8 @@ Administrators may start scheduled tasks on remote systems, but this activity is
 | 54.0 | 90 | 60 | A Windows Scheduled Task was ran on a remote endpoint from $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
index f8ec11c32f..90d87dfbf8 100644
--- a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
+++ b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
@@ -95,6 +95,8 @@ Administrators may create scheduled tasks on remote systems, but this activity i
 | 63.0 | 70 | 90 | A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
index 5b31526a77..6da0616322 100644
--- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
+++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
@@ -93,6 +93,8 @@ False positives are limited as legitimate applications typically do not download
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
index b6d405718a..b476e21d55 100644
--- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
+++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
@@ -87,6 +87,8 @@ It is possible to start this detection will need to be tuned by source IP or use
 | 10.0 | 20 | 50 | User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
index d9e21dab7d..5b91cf651a 100644
--- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
+++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
@@ -94,6 +94,8 @@ A network operator or systems administrator may utilize an automated powershell
 | 25.0 | 50 | 50 | csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
index acc93ec128..f667a632f5 100644
--- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
+++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
@@ -93,6 +93,8 @@ A network operator or systems administrator may utilize an automated or manual e
 | 25.0 | 50 | 50 | firewall allowed program commandline $process$ of $process_name$ on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
index 14ea7c8552..a08514361f 100644
--- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
+++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
@@ -94,6 +94,8 @@ A network operator or systems administrator may utilize an automated host discov
 | 9.0 | 30 | 30 | Network Connection discovery on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
index e52dfcd403..ea338a9ceb 100644
--- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
+++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
@@ -95,6 +95,8 @@ The wmic.exe utility is a benign Windows application. It may be used legitimatel
 | 49.0 | 70 | 70 | A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
index 8f685e0347..81a5081983 100644
--- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md
+++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
@@ -96,6 +96,8 @@ A network operator or systems administrator may utilize an automated or manual e
 | 25.0 | 50 | 50 | elevated process using runas on $dest$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
index cc3097ca71..3d3f8e7732 100644
--- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
+++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
@@ -100,6 +100,8 @@ Typically this will not trigger as by it&#39;s very nature InstallUtil does not
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-windows_installutil_remote_network_connection.md b/docs/_posts/2021-11-12-windows_installutil_remote_network_connection.md
index b2d5eead94..37e1e7a87b 100644
--- a/docs/_posts/2021-11-12-windows_installutil_remote_network_connection.md
+++ b/docs/_posts/2021-11-12-windows_installutil_remote_network_connection.md
@@ -109,6 +109,8 @@ Limited false positives should be present as InstallUtil is not typically used t
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
index a5303ed25a..83b51bc752 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
@@ -102,6 +102,8 @@ Limited false positives should be present. Filter as needed by parent process or
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option_with_network.md
index c7c35b0345..8ea6579420 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option_with_network.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option_with_network.md
@@ -110,6 +110,8 @@ Limited false positives should be present as InstallUtil is not typically used t
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
index acd2e14fc3..b9ee2a0617 100644
--- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
+++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
@@ -101,6 +101,8 @@ Limited false positives should be present as InstallUtil is not typically used t
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
index 1d7efb8ccc..da83592d5c 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
@@ -97,6 +97,8 @@ Administrators may leverage DCOM to start a process on remote systems, but this
 | 63.0 | 90 | 70 | A process was started on a remote endpoint from $dest by abusing DCOM using PowerShell.exe |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
index 31c362d421..2f8b64f447 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
@@ -86,6 +86,8 @@ Administrators may leverage DCOM to start a process on remote systems, but this
 | 63.0 | 90 | 70 | A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
index 650a366015..bdae3d1008 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
@@ -93,6 +93,8 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote
 | 63.0 | 90 | 70 | A process was started on a remote endpoint from $dest by abusing WMI using PowerShell.exe |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
index 49dd9cba40..6ccf682a67 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
@@ -82,6 +82,8 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote
 | 63.0 | 90 | 70 | A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-15-sdelete_application_execution.md b/docs/_posts/2021-11-15-sdelete_application_execution.md
index 3f17310abb..982e127ff0 100644
--- a/docs/_posts/2021-11-15-sdelete_application_execution.md
+++ b/docs/_posts/2021-11-15-sdelete_application_execution.md
@@ -94,6 +94,8 @@ False positives should be limited, filter as needed.
 | 42.0 | 60 | 70 | Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently delete files by $dest_user_id$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
index e45248901a..f0af880755 100644
--- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
+++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
@@ -92,6 +92,8 @@ It is possible false positives may be present based on the internal name dcinst.
 | 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
index 41ed212657..2ea20b8fdd 100644
--- a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
+++ b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
@@ -90,6 +90,8 @@ this behavior may seen in normal transfer of file within network if network shar
 | 9.0 | 30 | 30 | high frequency copy of document in network share $Share_Name$ from $Source_Address$ by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
index af40fbb3a6..49d8188e00 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
@@ -97,6 +97,8 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
 | 45.0 | 90 | 50 | A process was started on a remote endpoint from $dest by abusing WinRM using PowerShell.exe |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
index 1bcf227830..152434d386 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
@@ -86,6 +86,8 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
 | 45.0 | 90 | 50 | A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
index 8e77df5f17..122bab8808 100644
--- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md
+++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
@@ -96,6 +96,8 @@ Some legitimate administrative tools leverage `dism.exe` to manipulate packages
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
index b605ebb24c..431042e1cb 100644
--- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
+++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
@@ -92,6 +92,8 @@ System Administrators may use looks like PsExec for troubleshooting or administr
 | 70.0 | 70 | 100 | $user$ dropped or created an executable file in known sensitive SMB share.  Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
index ad920c5640..5e6a7e2015 100644
--- a/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
+++ b/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
@@ -85,6 +85,8 @@ Administrators may leverage WinRM and `Enter-PSSession` for administrative and t
 | 45.0 | 90 | 50 | An interactive session was opened on a remote endpoint from $ComputerName |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
index ee29a20b83..5950c87e09 100644
--- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
+++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
@@ -95,6 +95,8 @@ False positives should be limited, however it is possible to filter by Processes
 | 80.0 | 80 | 100 | dynwrapx.dll loaded by process $process_name$ on $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
index 490823f2f9..a7bf39af25 100644
--- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
+++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
@@ -93,6 +93,8 @@ This commandline can be used by a network administrator to audit host machine sp
 | 25.0 | 50 | 50 | dxdiag.exe process with commandline $process$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md b/docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md
index 19f5b47965..4a75f7bfb1 100644
--- a/docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md
+++ b/docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md
@@ -90,6 +90,8 @@ False positives can be ligitmate usage of archive tools from the command line.
 | 42.0 | 70 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
index 1c0e8720c5..2deb1507be 100644
--- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
+++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
@@ -96,6 +96,8 @@ False positive is quite limited. Filter is needed
 | 16.0 | 40 | 40 | suspicious process $process_name$ contains commandline $process$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
index f9bbabd63d..0a307098e4 100644
--- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
@@ -98,6 +98,8 @@ Legitimate applications may trigger this behavior, filter as needed.
 | 54.0 | 90 | 60 | Services.exe spawned a LOLBAS process on $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
index 82c11e57f5..cee8423a0b 100644
--- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
@@ -100,6 +100,8 @@ Legitimate applications may trigger this behavior, filter as needed.
 | 54.0 | 90 | 60 | Svchost.exe spawned a LOLBAS process on $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
index 2634f0736c..6b37ce8b37 100644
--- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
@@ -90,6 +90,8 @@ Legitimate applications may install services with uncommon services paths.
 | 56.0 | 70 | 80 | A service $Service_File_Name$ was created from a non-standard path using $Service_Name$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
index f62d5b2e57..33ee0b285d 100644
--- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
@@ -90,6 +90,8 @@ Legitimate applications may install services with uncommon services paths.
 | 54.0 | 90 | 60 | A Windows Service $Service_File_Name$ with a public path was created on $ComputerName |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
index 0efbc2f49d..ea6a345e33 100644
--- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
@@ -92,6 +92,8 @@ Legitimate applications may trigger this behavior, filter as needed.
 | 54.0 | 90 | 60 | Wmiprsve.exe spawned a LOLBAS process on $dest$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
index b0ebd18967..e3ccecabdc 100644
--- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
@@ -96,6 +96,8 @@ Legitimate applications may trigger this behavior, filter as needed.
 | 54.0 | 90 | 60 | Wsmprovhost.exe spawned a LOLBAS process on $dest$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
index 6440895765..96f8975616 100644
--- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
@@ -96,6 +96,8 @@ Legitimate applications may trigger this behavior, filter as needed.
 | 54.0 | 90 | 60 | Mmc.exe spawned a LOLBAS process on $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-24-attempt_to_delete_services.md b/docs/_posts/2021-11-24-attempt_to_delete_services.md
index 9302887f2d..20ebd11f9a 100644
--- a/docs/_posts/2021-11-24-attempt_to_delete_services.md
+++ b/docs/_posts/2021-11-24-attempt_to_delete_services.md
@@ -95,6 +95,8 @@ It is possible administrative scripts may start/stop/delete services. Filter as
 | 36.0 | 60 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-24-attempt_to_disable_services.md b/docs/_posts/2021-11-24-attempt_to_disable_services.md
index fad2f00ae8..273b5a26d8 100644
--- a/docs/_posts/2021-11-24-attempt_to_disable_services.md
+++ b/docs/_posts/2021-11-24-attempt_to_disable_services.md
@@ -85,6 +85,8 @@ It is possible administrative scripts may start/stop/delete services. Filter as
 | 36.0 | 60 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
index 265396e9d5..e7e3cedb19 100644
--- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
+++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
@@ -98,6 +98,8 @@ Admin or user may choose to use this windows features. Filter as needed.
 | 64.0 | 80 | 80 | exclusion command $process$ executed on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
index 969349fd4d..dd39a2490b 100644
--- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
+++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
@@ -90,6 +90,8 @@ admin or user may choose to use this windows features.
 | 64.0 | 80 | 80 | exclusion command $Message$ executed on $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
index 516edaa1f9..0ff7add633 100644
--- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
+++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
@@ -96,6 +96,8 @@ admin or user may choose to use this windows features.
 | 64.0 | 80 | 80 | exclusion registry $registry_path$  modified or added on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
index 9b79654157..7f140e4ff3 100644
--- a/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -88,6 +88,8 @@ None identified.
 | 63.0 | 70 | 90 | An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md b/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
index 457cc07576..aad5d24494 100644
--- a/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
+++ b/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
@@ -84,6 +84,8 @@ System administrators may use cacls utilities but this is not a common practice.
 | 35.0 | 50 | 70 | A cacls process $process_name$ with commandline $cmd_line$ try to deny a permission of a file or directory in host $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md b/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
index 5baebdaf4d..6887c2bd67 100644
--- a/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
+++ b/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
@@ -85,6 +85,8 @@ False positives should be limited, filter as needed.
 | 70.0 | 70 | 100 | A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ by user $dest_device_user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
index 76cdac2964..20462fc6f6 100644
--- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
@@ -91,6 +91,8 @@ False positives should be limited as this is restricted to the Rclone process na
 | 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
index 86e05f4201..f604258041 100644
--- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
+++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
@@ -121,6 +121,8 @@ Legitimate applications may spawn PowerShell as a child process of the the ident
 | 45.0 | 90 | 50 | A PowerShell process was spawned as a child process of typically abused processes on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
index e164fa1163..b8e71a5ef6 100644
--- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
+++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
@@ -95,6 +95,8 @@ Legitimate applications may use random Scheduled Task names.
 | 45.0 | 90 | 50 | A windows scheduled task with a suspicious task name was created on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
index 5ba0161e69..3bc89d7f1b 100644
--- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
+++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
@@ -93,6 +93,8 @@ Legitimate applications may use random Windows Service names.
 | 45.0 | 90 | 50 | A Windows Service with a suspicious service name was installed on $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-30-delete_a_net_user.md b/docs/_posts/2021-11-30-delete_a_net_user.md
index 6421067430..e900f9596a 100644
--- a/docs/_posts/2021-11-30-delete_a_net_user.md
+++ b/docs/_posts/2021-11-30-delete_a_net_user.md
@@ -85,6 +85,8 @@ System administrators or scripts may delete user accounts via this technique. Fi
 | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user account. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-30-disable_net_user_account.md b/docs/_posts/2021-11-30-disable_net_user_account.md
index d1e27763ef..338948cfad 100644
--- a/docs/_posts/2021-11-30-disable_net_user_account.md
+++ b/docs/_posts/2021-11-30-disable_net_user_account.md
@@ -92,6 +92,8 @@ System administrators or automated scripts may disable an account but not a comm
 | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md b/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
index 4176a5a754..772947375d 100644
--- a/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
+++ b/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
@@ -95,6 +95,8 @@ Legitimate programs use command-line arguments to execute. Verify the command-li
 | 30.0 | 50 | 60 | A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md b/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
index b7ee185816..82e83d9b3e 100644
--- a/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
+++ b/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
@@ -84,6 +84,8 @@ System administrators may use cacls utilities but this is not a common practice.
 | 35.0 | 50 | 70 | A cacls process $process_name$ with commandline $cmd_line$ try to grant user a permission to a file or directory in host $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md b/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
index 140d48235c..85e019e720 100644
--- a/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
+++ b/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
@@ -84,6 +84,8 @@ System administrators may use this windows utility. filter is needed.
 | 35.0 | 50 | 70 | A cacls process $process_name$ with commandline $cmd_line$ try to modify a permission of a file or directory in host $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md b/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
index ec50ffb429..cb904cf6c1 100644
--- a/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
+++ b/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
@@ -98,6 +98,8 @@ Environments in which NTLM is used extremely rarely and for benign purposes (suc
 | 72.0 | 80 | 90 | Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the destination device $dest_device_id$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md b/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
index 984825bc9c..c0f55a8d7b 100644
--- a/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
+++ b/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
@@ -101,6 +101,8 @@ Some custom tools used by administrators could be used rarely to launch remotely
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-11-30-resize_shadowstorage_volume.md b/docs/_posts/2021-11-30-resize_shadowstorage_volume.md
index 799464a3c7..ce8824c5ba 100644
--- a/docs/_posts/2021-11-30-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-11-30-resize_shadowstorage_volume.md
@@ -85,6 +85,8 @@ System administrators may resize the shadowstorage for valid purposes. Filter as
 | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow copy to perform offline password cracking. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
index 8dc2c055f3..14e7d69e3d 100644
--- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
+++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
@@ -94,6 +94,8 @@ An single endpoint requesting a large number of computer service tickets is not
 | 42.0 | 70 | 60 | None |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
index e700f17467..869e1014d4 100644
--- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
+++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
@@ -94,6 +94,8 @@ An single endpoint authenticating to a large number of hosts is not common behav
 | 42.0 | 70 | 60 | None |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md b/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md
index 6b89f0a352..7290546680 100644
--- a/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md
@@ -87,6 +87,8 @@ False positives should be limited as this is restricted to the Rclone process na
 | 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote cloud service to move files or folders. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-03-short_lived_scheduled_task.md b/docs/_posts/2021-12-03-short_lived_scheduled_task.md
index 2aa8452b36..21047f2129 100644
--- a/docs/_posts/2021-12-03-short_lived_scheduled_task.md
+++ b/docs/_posts/2021-12-03-short_lived_scheduled_task.md
@@ -88,6 +88,8 @@ Although uncommon, legitimate applications may create and delete a Scheduled Tas
 | 81.0 | 90 | 90 | A windows scheduled task was created and deleted in 30 seconds on $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md
index df2b4494c1..34494a69ee 100644
--- a/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md
+++ b/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md
@@ -92,6 +92,8 @@ False positives may be limited to source control applications and may be require
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote destination. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md b/docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md
index 92781e721f..3c0d2cfbe9 100644
--- a/docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md
+++ b/docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md
@@ -88,6 +88,8 @@ Shared workstations can cause false positives
 | 6.0 | 20 | 30 | Multiple interactive logins detected on $device$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md b/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md
index 45f5ad0ac5..a4c08b68a6 100644
--- a/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md
+++ b/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md
@@ -85,6 +85,8 @@ Administrators may modify the boot configuration.
 | 80.0 | 100 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability to recover the endpoint. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md
index dc6f05edf9..c982c2c963 100644
--- a/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md
+++ b/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md
@@ -89,6 +89,8 @@ It is possible for some legitimate administrative utilities to use similar cmd_l
 | 72.0 | 90 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-excessive_number_of_office_files_copied.md b/docs/_posts/2021-12-07-excessive_number_of_office_files_copied.md
index d737cce0e2..dab2b36dee 100644
--- a/docs/_posts/2021-12-07-excessive_number_of_office_files_copied.md
+++ b/docs/_posts/2021-12-07-excessive_number_of_office_files_copied.md
@@ -80,6 +80,8 @@ user may copy a lot of office fies from one folder to another
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-fsutil_zeroing_file.md b/docs/_posts/2021-12-07-fsutil_zeroing_file.md
index 9d4f64b89a..7017500520 100644
--- a/docs/_posts/2021-12-07-fsutil_zeroing_file.md
+++ b/docs/_posts/2021-12-07-fsutil_zeroing_file.md
@@ -84,6 +84,8 @@ System administrators or scripts may delete user accounts via this technique. Fi
 | 54.0 | 60 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-high_file_deletion_frequency.md b/docs/_posts/2021-12-07-high_file_deletion_frequency.md
index af592b6d9c..beb291bc14 100644
--- a/docs/_posts/2021-12-07-high_file_deletion_frequency.md
+++ b/docs/_posts/2021-12-07-high_file_deletion_frequency.md
@@ -87,6 +87,8 @@ user may delete bunch of pictures or files in a folder.
 | 72.0 | 90 | 80 | High frequency file deletion activity detected on host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md b/docs/_posts/2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md
index 685850030a..a7dcb6e348 100644
--- a/docs/_posts/2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md
+++ b/docs/_posts/2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md
@@ -105,6 +105,8 @@ The query is structured in a way that `action` (read, create) is not defined. Re
 | 81.0 | 90 | 90 | A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md b/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md
index d4b331be14..8fe8ec4e3c 100644
--- a/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md
+++ b/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md
@@ -85,6 +85,8 @@ Administrators may modify the boot configuration.
 | 15.0 | 30 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
index 71de4d0d45..392f00aab3 100644
--- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
+++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
@@ -92,6 +92,8 @@ False positives should be limited, however filter as needed.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md b/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
index e6a93e9ad7..3b4c5cea0f 100644
--- a/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
+++ b/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
@@ -89,6 +89,8 @@ Admin or user may choose to disable windows defender product
 | 49.0 | 70 | 70 | Modified/added/deleted registry entry $registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
index fd7f8bf0f0..9f1afde51e 100644
--- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
+++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
@@ -98,6 +98,8 @@ It is possible some Administrative utilities will load msi.dll outside of normal
 | 56.0 | 80 | 70 | The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
index c94eb70ab9..09180df532 100644
--- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
@@ -94,6 +94,8 @@ False positives should be limited, however filtering may be required.
 | 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
index c851860a38..7b1f213d61 100644
--- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
@@ -94,6 +94,8 @@ False positives should be limited, however filtering may be required.
 | 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
index 5ece6f277d..f4fc63f232 100644
--- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
+++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
@@ -90,6 +90,8 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr
 | 56.0 | 70 | 80 | An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
index 7183d921ee..91d5c3769f 100644
--- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
+++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
@@ -87,6 +87,8 @@ Filtering may be required in some instances, filter as needed.
 | 40.0 | 80 | 50 | A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve a remote class file. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
index 50fbcfd330..8626fec415 100644
--- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md
+++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
@@ -94,6 +94,8 @@ Filtering may be required on internal developer build systems or classify assets
 | 40.0 | 80 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
index e24ae67179..1abf4a9a91 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
@@ -97,6 +97,8 @@ If there is a vulnerablility scannner looking for log4shells this will trigger,
 | 15.0 | 50 | 30 | CVE-2021-44228 Log4Shell triggered for host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
index 974244c92d..1117da60dd 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
@@ -105,6 +105,8 @@ If there is a vulnerablility scannner looking for log4shells this will trigger,
 | 15.0 | 50 | 30 | CVE-2021-44228 Log4Shell triggered for host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
index 10b60d8dde..f67564e419 100644
--- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
+++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
@@ -95,6 +95,8 @@ Legitimate Java applications may use perform outbound connections to these ports
 | 54.0 | 90 | 60 | Java performed outbound connections to default ports of LDAP or RMI on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
index 0cb9f72e70..109504d529 100644
--- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md
+++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
@@ -96,6 +96,8 @@ Filtering may be required on internal developer build systems or classify assets
 | 40.0 | 80 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md
index 2803a88c41..a410fa6e1e 100644
--- a/docs/_posts/2021-12-14-hunting_for_log4shell.md
+++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md
@@ -210,6 +210,8 @@ It is highly possible you will find false positives, however, the base score is
 | 40.0 | 80 | 50 | Hunting for Log4Shell exploitation has occurred. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
index 5152c627eb..c9ca7fa5a3 100644
--- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
+++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
@@ -95,6 +95,8 @@ Administrator or network operator can create file in crontab folders for automat
 | 25.0 | 50 | 50 | a file $file_name$ is created in $file_path$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
index a3babaa500..4764bc6d90 100644
--- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
+++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
@@ -95,6 +95,8 @@ Administrator or network operator can create this file for automation purposes.
 | 25.0 | 50 | 50 | A file $file_name$ is created in $file_path$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-17-linux_at_application_execution.md b/docs/_posts/2021-12-17-linux_at_application_execution.md
index 67b8a675f7..cd14162883 100644
--- a/docs/_posts/2021-12-17-linux_at_application_execution.md
+++ b/docs/_posts/2021-12-17-linux_at_application_execution.md
@@ -97,6 +97,8 @@ Administrator or network operator can use this application for automation purpos
 | 9.0 | 30 | 30 | At application was executed in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
index 339978e964..418ec1462c 100644
--- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
+++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
@@ -97,6 +97,8 @@ Administrator or network operator can use this application for automation purpos
 | 9.0 | 30 | 30 | A possible crontab edit command $process$ executed on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
index a60a50b51c..4081d3f813 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
@@ -97,6 +97,8 @@ Administrator or network operator can use this commandline for automation purpos
 | 9.0 | 30 | 30 | A commandline $process$ that may modify at allow config file in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
index 71526a77d8..65d163f593 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
@@ -97,6 +97,8 @@ Administrator or network operator can use this commandline for automation purpos
 | 49.0 | 70 | 70 | A commandline $process$ that may modify cronjob file in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
index e4f17d7539..623009b971 100644
--- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
+++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
@@ -97,6 +97,8 @@ Administrator or network operator can use this commandline for automation purpos
 | 6.0 | 20 | 30 | A commandline $process$ that may modify cronjob file using editor in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md
index 4793a21302..60c077cd42 100644
--- a/docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md
+++ b/docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md
@@ -93,6 +93,8 @@ administrator may execute this app to manage disk
 | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md
index d62effeb2c..1e044103fd 100644
--- a/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md
+++ b/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md
@@ -83,6 +83,8 @@ Some applications and users may legitimately use attrib.exe to interact with the
 | 72.0 | 80 | 90 | Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
index 70ca9d5667..08718fdfe8 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
@@ -93,6 +93,8 @@ Administrator or network operator can create file in this folders for automation
 | 49.0 | 70 | 70 | A file $file_name$ is created in $file_path$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
index 3a31074eb1..35c1b258cc 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
@@ -93,6 +93,8 @@ Administrator or network operator can create file in profile.d folders for autom
 | 56.0 | 70 | 80 | A file $file_name$ is created in $file_path$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
index 489b2c3aee..5ea02084c6 100644
--- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
+++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
@@ -95,6 +95,8 @@ Administrator or network operator can use this commandline for automation purpos
 | 49.0 | 70 | 70 | a commandline $process$ that may modify profile files in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
index b5e9a04920..ccc9a36100 100644
--- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
+++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
@@ -95,6 +95,8 @@ Administrator or network operator can create file in systemd folders for automat
 | 64.0 | 80 | 80 | A service file named as $file_path$ is created in systemd folder on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md
index d3f0e5daa0..85e0c4bdb7 100644
--- a/docs/_posts/2021-12-20-linux_service_restarted.md
+++ b/docs/_posts/2021-12-20-linux_service_restarted.md
@@ -97,6 +97,8 @@ Administrator or network operator can use this commandline for automation purpos
 | 25.0 | 50 | 50 | A commandline $process$ that may create or start a service on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
index f569401d66..3c0e0e66d9 100644
--- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
+++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
@@ -97,6 +97,8 @@ Administrator or network operator can use this commandline for automation purpos
 | 42.0 | 60 | 70 | a commandline $process$ that may create or start a service on $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
index bc8b5448c2..44799e7a11 100644
--- a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
+++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
@@ -94,6 +94,8 @@ Renaming a computer account name to a name that not end with &#39;$&#39; is high
 | 70.0 | 100 | 70 | A computer account $Old_Account_Name$ was renamed with a suspicious computer name |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
index d9971c5334..904e4e32cd 100644
--- a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
+++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
@@ -96,6 +96,8 @@ We have tested this detection logic with ~2 million 4769 events and did not iden
 | 60.0 | 100 | 60 | A suspicious Kerberos Service Ticket was requested by $Account_Name$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md
index f4e3ac46f6..d3a0bfe619 100644
--- a/docs/_posts/2021-12-21-linux_add_user_account.md
+++ b/docs/_posts/2021-12-21-linux_add_user_account.md
@@ -93,6 +93,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 25.0 | 50 | 50 | A commandline $process$ that may create user account on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
index 3d8943df40..e9bb5b99fa 100644
--- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
+++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
@@ -93,6 +93,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 64.0 | 80 | 80 | A commandline $process$ that may change ownership to root on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
index f17c0891e8..69d1b236c2 100644
--- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
+++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 64.0 | 80 | 80 | a commandline $process$ executed on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
index 201372e990..87d9ca9071 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 49.0 | 70 | 70 | a commandline $process$ that may set suid or sgid on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
index 585594f569..cdddbcfb93 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 49.0 | 70 | 70 | A commandline $process$ that may set suid or sgid on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
index ce41fed013..4800fadf07 100644
--- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
+++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 16.0 | 40 | 40 | A commandline $process$ executed on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
index 596365663c..90bc4ad1e6 100644
--- a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
+++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
@@ -96,6 +96,8 @@ A computer account name change event inmediately followed by a kerberos TGT requ
 | 60.0 | 100 | 60 | A suspicious TGT was requested was requested |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
index 0091309750..2aa016963a 100644
--- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
+++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
@@ -93,6 +93,8 @@ Administrator or network operator can create file in this folders for automation
 | 72.0 | 80 | 90 | A file $file_name$ is created in $file_path$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
index cc743a6317..dcc364812c 100644
--- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
+++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 64.0 | 80 | 80 | A commandline $process$ that may install kernel module on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
index 354a4a0097..6512abe6fd 100644
--- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
+++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 64.0 | 80 | 80 | A commandline $process$ that may install kernel module on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
index 1c9c29e949..81d48ae8ad 100644
--- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
+++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
@@ -97,6 +97,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 64.0 | 80 | 80 | A commandline $process$ that may hijack library function on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
index 118d20e4bd..77a3d7c5b0 100644
--- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
+++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 9.0 | 30 | 30 | A commandline $process$ with process $process_name$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
index d7a906592f..cb9ef23d9b 100644
--- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
+++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
@@ -93,6 +93,8 @@ administrator or network operator can execute this command. Please update the fi
 | 72.0 | 80 | 90 | A file $file_name$ is created in $file_path$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
index f207019a9a..89ffa17595 100644
--- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
+++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 9.0 | 30 | 30 | A commandline $process$ that execute sudo or su in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
index 2d4edd907c..5318b75d2d 100644
--- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
+++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
@@ -93,6 +93,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 49.0 | 70 | 70 | A file $file_name$ is created in $file_path$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
index a2e7aad807..1f0f1d2c32 100644
--- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md
+++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
@@ -95,6 +95,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 49.0 | 70 | 70 | A doas $process_name$ with commandline $process$ was executed on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
index 7f6f7490d2..5c6249f0ed 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
@@ -93,6 +93,8 @@ Administrator or network operator can execute this command. Please update the fi
 | 25.0 | 50 | 50 | A commandline $process$ executed on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
index bf9dcbd7b4..0df3228295 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
@@ -95,6 +95,8 @@ administrator or network operator can execute this command. Please update the fi
 | 25.0 | 50 | 50 | A commandline $process$ executed on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
index 68c2684609..6c5e71d0a5 100644
--- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
+++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
@@ -93,6 +93,8 @@ Administrator or network operator can use this commandline for automation purpos
 | 25.0 | 50 | 50 | a commandline $process$ executed on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
index 3f204e6358..6bcf9ae8f2 100644
--- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
+++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
@@ -91,6 +91,8 @@ Administrator or network operator can create file in ~/.ssh folders for automati
 | 36.0 | 60 | 60 | A file $file_name$ is created in $file_path$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
index d2132781db..24d8c4ed20 100644
--- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
+++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
@@ -101,6 +101,8 @@ Legitimate process can have this combination of command-line options, but it&#39
 | 81.0 | 90 | 90 | PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
index 45bcd24b33..13cddd2ebb 100644
--- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
@@ -91,6 +91,8 @@ False positives will occur based on GrantedAccess and SourceUser, filter based o
 | 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
index fa3994bf8b..a559fea6bd 100644
--- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
@@ -91,6 +91,8 @@ False positives will occur based on legitimate application requests, filter base
 | 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
index 397fd6e0a5..0bc4821944 100644
--- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
+++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
@@ -94,6 +94,8 @@ This model is an anomaly detector that identifies usage of APIs and scripting co
 | 12.0 | 60 | 20 | Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
index a891f74f40..0a8920ab37 100644
--- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
+++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
@@ -98,6 +98,8 @@ False positives may be high based on legitimate scripted code in any environment
 | 30.0 | 60 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
index f97c07a952..50250df870 100644
--- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
+++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
@@ -110,6 +110,8 @@ Although uncommon, Administrators may leverage Impackets tools to start a proces
 | 63.0 | 90 | 70 | Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
index a3a7cb6c84..77aa316328 100644
--- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
+++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
@@ -99,6 +99,8 @@ System administrators may use this option, but it&#39;s not common.
 | 35.0 | 70 | 50 | Powershell.exe running potentially malicious encodede commands on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
index c700b9ca00..69982e4121 100644
--- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
+++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
@@ -91,6 +91,8 @@ Noise and false positive can be seen if the following instant messaging is allow
 | 64.0 | 80 | 80 | suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
index 7b91a5acff..2f3c7b3e7a 100644
--- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
+++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
@@ -91,6 +91,8 @@ Noise and false positive can be seen if the following instant messaging is allow
 | 64.0 | 80 | 80 | suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
index bf057bff01..c6d6de98c3 100644
--- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
@@ -116,6 +116,8 @@ False positives may be present and filtering may be required. Certain utilities
 | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
index 4b1368edc5..d087f2627b 100644
--- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
@@ -109,6 +109,8 @@ False positives may be present and filtering may be required. Certain utilities
 | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
index fc05fc993f..3b440cbe14 100644
--- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
+++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
@@ -87,6 +87,8 @@ Windows Defender AV updates may cause this alert. Please update the filter macro
 | 25.0 | 50 | 50 | High frequency file deletion activity detected on host $Computer$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
index 029d6e3423..0f1c56ccbc 100644
--- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md
+++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
@@ -99,6 +99,8 @@ Administrator or network operator may execute this command. Please update the fi
 | 36.0 | 60 | 60 | suspicious $process$ commandline run in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-20-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-20-powershell_remove_windows_defender_directory.md
index de45894194..a38401c6af 100644
--- a/docs/_posts/2022-01-20-powershell_remove_windows_defender_directory.md
+++ b/docs/_posts/2022-01-20-powershell_remove_windows_defender_directory.md
@@ -88,6 +88,8 @@ unknown
 | 90.0 | 100 | 90 | suspicious powershell script $Message$ was executed on the $ComputerName$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
index 43706a9f76..54cc011861 100644
--- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
+++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
@@ -94,6 +94,8 @@ False positives should be limited as it is specific to AdvancedRun. Filter as ne
 | 60.0 | 60 | 100 | An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
index c961456605..f2892c1250 100644
--- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
+++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
@@ -99,6 +99,8 @@ False positives may be present. Filtering may be required before setting to aler
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-active_setup_registry_autostart.md b/docs/_posts/2022-01-26-active_setup_registry_autostart.md
index 460bf6c2e2..bf1875433b 100644
--- a/docs/_posts/2022-01-26-active_setup_registry_autostart.md
+++ b/docs/_posts/2022-01-26-active_setup_registry_autostart.md
@@ -97,6 +97,8 @@ Active setup installer may add or modify this registry.
 | 64.0 | 80 | 80 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
index ca6a157521..a636171be5 100644
--- a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
+++ b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
@@ -93,6 +93,8 @@ unknown
 | 25.0 | 50 | 50 | modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
index a7b15e6750..da2dc82e98 100644
--- a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
+++ b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
@@ -101,6 +101,8 @@ network admin may add/remove/modify public inbound firewall rule that may cause
 | 3.0 | 10 | 30 | Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
index 80f33518a0..f0d97fc718 100644
--- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
+++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
@@ -90,6 +90,8 @@ unknown
 | 25.0 | 50 | 50 | Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-disable_amsi_through_registry.md b/docs/_posts/2022-01-26-disable_amsi_through_registry.md
index 0621aa8625..cdcbed47d0 100644
--- a/docs/_posts/2022-01-26-disable_amsi_through_registry.md
+++ b/docs/_posts/2022-01-26-disable_amsi_through_registry.md
@@ -88,6 +88,8 @@ network operator may disable this feature of windows but not so common.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
index 65057953af..9b8e7ed29a 100644
--- a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
+++ b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
@@ -95,6 +95,8 @@ admin or user may choose to disable windows defender product
 | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
index a09d6314d3..e8d4c467b3 100644
--- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
@@ -95,6 +95,8 @@ admin or user may choose to disable windows defender product
 | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
index c52614d3b8..e0b4a40c50 100644
--- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
+++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
@@ -95,6 +95,8 @@ user may choose to disable windows defender AV
 | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
index b0a530f68a..80e4228df7 100644
--- a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
+++ b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
@@ -95,6 +95,8 @@ admin or user may choose to disable windows defender product
 | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
index e51092b463..9cf104cbad 100644
--- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
+++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
@@ -95,6 +95,8 @@ admin or user may choose to disable windows defender product
 | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
index f05592e28b..be48656b1f 100644
--- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
@@ -95,6 +95,8 @@ admin or user may choose to disable windows defender product
 | 49.0 | 70 | 70 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
index 294978966c..c18fc7f288 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
@@ -103,6 +103,8 @@ There are many legitimate applications that must execute on system startup and w
 | 76.0 | 80 | 95 | A registry activity in $registry_path$ related to persistence in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
index 7dfdde8d2f..390580e235 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
@@ -96,6 +96,8 @@ There are many legitimate applications that must execute upon system startup and
 | 76.0 | 80 | 95 | A registry activity in $registry_path$ related to privilege escalation in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
index bfea23a4ad..ebba1879a8 100644
--- a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
+++ b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
@@ -90,6 +90,8 @@ unknown
 | 90.0 | 90 | 100 | A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
index e3efff97ef..9398b4fa95 100644
--- a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
+++ b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
@@ -95,6 +95,8 @@ updated windows application needed in safe boot may used this registry
 | 42.0 | 60 | 70 | Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-26-time_provider_persistence_registry.md b/docs/_posts/2022-01-26-time_provider_persistence_registry.md
index 0ca7694ccd..5058d02a31 100644
--- a/docs/_posts/2022-01-26-time_provider_persistence_registry.md
+++ b/docs/_posts/2022-01-26-time_provider_persistence_registry.md
@@ -97,6 +97,8 @@ unknown
 | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disable_etw_through_registry.md b/docs/_posts/2022-01-27-disable_etw_through_registry.md
index 45cf120da4..d6c9352ab5 100644
--- a/docs/_posts/2022-01-27-disable_etw_through_registry.md
+++ b/docs/_posts/2022-01-27-disable_etw_through_registry.md
@@ -88,6 +88,8 @@ network operator may disable this feature of windows but not so common.
 
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disable_registry_tool.md b/docs/_posts/2022-01-27-disable_registry_tool.md
index 4ac46cd21e..a6e93d7800 100644
--- a/docs/_posts/2022-01-27-disable_registry_tool.md
+++ b/docs/_posts/2022-01-27-disable_registry_tool.md
@@ -94,6 +94,8 @@ admin may disable this application for non technical user.
 | 40.0 | 40 | 100 | Disabled Registry Tools on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
index 016237d022..167db9fe4f 100644
--- a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
+++ b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
@@ -91,6 +91,8 @@ Unknown.
 | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md
index 4b7389618c..5cf447c922 100644
--- a/docs/_posts/2022-01-27-disable_show_hidden_files.md
+++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md
@@ -102,6 +102,8 @@ unknown
 | 40.0 | 40 | 100 | Disabled &#39;Show Hidden Files&#39; on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
index faaf0f4fe8..6c90d86a71 100644
--- a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
+++ b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
@@ -98,6 +98,8 @@ admin may set this policy for non-critical machine.
 | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
index 1cc4d3a015..3f01672b0b 100644
--- a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
+++ b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
@@ -93,6 +93,8 @@ unknown
 | 40.0 | 40 | 100 | Disabled &#39;Windows App Hotkeys&#39; on $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
index 136c3add9e..f43a20aa48 100644
--- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
+++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
@@ -96,6 +96,8 @@ admin or user may choose to disable this windows features.
 | 40.0 | 40 | 100 | Windows Defender real time behavior monitoring disabled on $dest |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
index 3c6e276535..ec9382e96e 100644
--- a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
+++ b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
@@ -94,6 +94,8 @@ admin or user may choose to disable this windows features.
 | 25.0 | 50 | 50 | The Windows Smartscreen was disabled on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disabling_cmd_application.md b/docs/_posts/2022-01-27-disabling_cmd_application.md
index 73e7642282..f9c5fb91cd 100644
--- a/docs/_posts/2022-01-27-disabling_cmd_application.md
+++ b/docs/_posts/2022-01-27-disabling_cmd_application.md
@@ -94,6 +94,8 @@ admin may disable this application for non technical user.
 | 25.0 | 50 | 50 | The Windows command prompt was disabled on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-disabling_controlpanel.md b/docs/_posts/2022-01-27-disabling_controlpanel.md
index 52838b09fa..09083edf53 100644
--- a/docs/_posts/2022-01-27-disabling_controlpanel.md
+++ b/docs/_posts/2022-01-27-disabling_controlpanel.md
@@ -94,6 +94,8 @@ admin may disable this application for non technical user.
 | 25.0 | 50 | 50 | The Windows Control Panel was disabled on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
index 26844d786a..99535d0a00 100644
--- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
+++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
@@ -97,6 +97,8 @@ False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter base
 | 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-disabling_defender_services.md b/docs/_posts/2022-01-28-disabling_defender_services.md
index f81b37212a..734a7fedfc 100644
--- a/docs/_posts/2022-01-28-disabling_defender_services.md
+++ b/docs/_posts/2022-01-28-disabling_defender_services.md
@@ -95,6 +95,8 @@ admin or user may choose to disable windows defender product
 | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
index 4358b4c47e..5728ad355a 100644
--- a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
+++ b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
@@ -94,6 +94,8 @@ admin may disable this application for non technical user.
 | 25.0 | 50 | 50 | The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-disabling_norun_windows_app.md b/docs/_posts/2022-01-28-disabling_norun_windows_app.md
index 6d80b7dc70..b280e211fd 100644
--- a/docs/_posts/2022-01-28-disabling_norun_windows_app.md
+++ b/docs/_posts/2022-01-28-disabling_norun_windows_app.md
@@ -94,6 +94,8 @@ admin may disable this application for non technical user.
 | 25.0 | 50 | 50 | The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
index 5e417a47c8..2a79f3d72c 100644
--- a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
+++ b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
@@ -94,6 +94,8 @@ in some cases admin can disable systemrestore on a machine.
 | 49.0 | 70 | 70 | The Windows registry was modified to disable system restore on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-disabling_task_manager.md b/docs/_posts/2022-01-28-disabling_task_manager.md
index e31d7f2223..7fb480fba5 100644
--- a/docs/_posts/2022-01-28-disabling_task_manager.md
+++ b/docs/_posts/2022-01-28-disabling_task_manager.md
@@ -94,6 +94,8 @@ admin may disable this application for non technical user.
 | 42.0 | 70 | 60 | The Windows Task Manager was disabled on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
index fdc3707321..f628fad846 100644
--- a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
+++ b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
@@ -89,6 +89,8 @@ unknown
 | 80.0 | 80 | 100 | RDP was moved to a non-standard port on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
index 8f7d038d05..151a0fbeb0 100644
--- a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
+++ b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
@@ -95,6 +95,8 @@ unknown
 | 80.0 | 80 | 100 | wdigest registry $registry_path$ was modified in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-etw_registry_disabled.md b/docs/_posts/2022-01-28-etw_registry_disabled.md
index 8748cce5b2..45e15fbea7 100644
--- a/docs/_posts/2022-01-28-etw_registry_disabled.md
+++ b/docs/_posts/2022-01-28-etw_registry_disabled.md
@@ -100,6 +100,8 @@ unknown
 | 90.0 | 90 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
index 2bde8515cf..91ef50283e 100644
--- a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
+++ b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
@@ -98,6 +98,8 @@ Some false positives may be present and will need to be filtered.
 | 80.0 | 80 | 100 | Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
index 9779d2edd5..1b269f9c8a 100644
--- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
+++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
@@ -93,6 +93,8 @@ Unknown. Filter as needed.
 | 72.0 | 90 | 80 | Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
index 70fec62f2d..bf36b695d2 100644
--- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
+++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
@@ -94,6 +94,8 @@ False positives may be present, filter as needed.
 | 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit pkexec. |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 #### CVE
 
diff --git a/docs/_posts/2022-02-03-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md
index 103f6f4c37..0636183fc1 100644
--- a/docs/_posts/2022-02-03-o365_added_service_principal.md
+++ b/docs/_posts/2022-02-03-o365_added_service_principal.md
@@ -92,6 +92,8 @@ The creation of a new Federation is not necessarily malicious, however these eve
 | 42.0 | 70 | 60 | User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
index d8bd5c3b46..b3daa88f8a 100644
--- a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
+++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
@@ -98,6 +98,8 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to
 | 42.0 | 70 | 60 | User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md
index 37cc71ff03..1f26ebba0a 100644
--- a/docs/_posts/2022-02-03-o365_disable_mfa.md
+++ b/docs/_posts/2022-02-03-o365_disable_mfa.md
@@ -89,6 +89,8 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat
 | 64.0 | 80 | 80 | User $user$ has executed an operation $Operation$ for this destination $dest$ |
 
 
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 
 
 #### Reference
diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md
index 99b0828fa0..a3f454b5e4 100644
--- a/docs/_stories/credential_dumping.md
+++ b/docs/_stories/credential_dumping.md
@@ -35,8 +35,8 @@ The detection searches in this Analytic Story monitor access to the Local Securi
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md
index 670239b265..001a481dac 100644
--- a/docs/_stories/windows_defense_evasion_tactics.md
+++ b/docs/_stories/windows_defense_evasion_tactics.md
@@ -51,8 +51,8 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [Firewall Allowed Program Enable](/endpoint/firewall_allowed_program_enable/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Powershell Windows Defender Exclusion Commands](/endpoint/powershell_windows_defender_exclusion_commands/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
diff --git a/docs/_stories/windows_persistence_techniques.md b/docs/_stories/windows_persistence_techniques.md
index b40b5b83ea..6643cec58e 100644
--- a/docs/_stories/windows_persistence_techniques.md
+++ b/docs/_stories/windows_persistence_techniques.md
@@ -36,8 +36,8 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
 | [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP |
 | [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |

From a1d127126af102591ffa0d095d99a9a5840c90f5 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 14 Feb 2022 11:11:47 -0500
Subject: [PATCH 26/42] adding template detection

---
 ...connect_to_internet_with_hidden_window.yml | 47 +++++++++++++++++++
 ...ct_to_internet_with_hidden_window.test.yml | 12 +++++
 2 files changed, 59 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
 create mode 100644 tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml

diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
new file mode 100644
index 0000000000..45bd27c042
--- /dev/null
+++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -0,0 +1,47 @@
+name: Windows Powershell Connect to Internet With Hidden Window
+id: 477e068e-8b6d-11ec-b6c1-81af21670352
+version: 1
+date: '2022-02-11'
+author: Jose Hernandez
+type: Anomaly
+datamodel:
+- Endpoint
+description: 
+	UPDATE_DESCRIPTION
+	WHAT IS THIS?
+	WHAT DOES IT LOOK LIKE?
+	HOW DO YOU TRIAGE IT?
+search: '| UPDATE_SPL | `windows_powershell_connect_to_internet_with_hidden_window_filter`'
+how_to_implement: UPDATE_HOW_TO_IMPLEMENT
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+-  
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Exploitation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1059.001
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 
+  confidence: 
+  # (impact * confidence)/100
+  risk_score: 
+  context:
+  message: 
+  observable:
+  nist:
+  -
+  cis20:
+  -
\ No newline at end of file
diff --git a/tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml b/tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml
new file mode 100644
index 0000000000..40e7685175
--- /dev/null
+++ b/tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml
@@ -0,0 +1,12 @@
+name: Windows Powershell Connect to Internet With Hidden Window Unit Test
+tests:
+- name: Windows Powershell Connect to Internet With Hidden Window
+  file: endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file

From 0a2618f68655fdd3e3e97010dde800d163a1fbfe Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 14 Feb 2022 13:40:24 -0500
Subject: [PATCH 27/42] adding 1 detection

---
 ...connect_to_internet_with_hidden_window.yml | 115 +++++++++++++-----
 ...ct_to_internet_with_hidden_window.test.yml |  12 +-
 2 files changed, 89 insertions(+), 38 deletions(-)

diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index 45bd27c042..c39f728f26 100644
--- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -2,46 +2,99 @@ name: Windows Powershell Connect to Internet With Hidden Window
 id: 477e068e-8b6d-11ec-b6c1-81af21670352
 version: 1
 date: '2022-02-11'
-author: Jose Hernandez
+author: Jose Hernandez, David Dorsey, Michael Haag Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: 
-	UPDATE_DESCRIPTION
-	WHAT IS THIS?
-	WHAT DOES IT LOOK LIKE?
-	HOW DO YOU TRIAGE IT?
-search: '| UPDATE_SPL | `windows_powershell_connect_to_internet_with_hidden_window_filter`'
-how_to_implement: UPDATE_HOW_TO_IMPLEMENT
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+description: The following hunting analytic identifies PowerShell commands utilizing
+  the WindowStyle parameter to hide the window on the compromised endpoint. This combination
+  of command-line options is suspicious because it is overriding the default PowerShell
+  execution policy, attempts to hide its activity from the user, and connects to the
+  Internet. Removed in this version of the query is New-Object. The analytic identifies
+  all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter.
+  For example w, win, windowsty and so forth. In addition, through our research it
+  was identified that PowerShell will interpret different command switch types beyond
+  the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
+search: '| from pulsar("d156ed3a-1254-469a-bffc-9dd6eda97ac6", "persistent://ssa/egress/decorated-events-research") 
+| eval input_event=deserialize_json_object(value) 
+| select input_event 
+| eval _datamodels=ucast(map_get(input_event, "_datamodels"), "collection<string>", []), body={} 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
+| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
+| where match_regex(cmd_line, /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();'
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+known_false_positives: Legitimate process can have this combination of command-line
+  options, but it's not common.
 references:
--  
+- https://regexr.com/663rr
+- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
+- https://ss64.com/ps/powershell.html
+- https://twitter.com/M_haggis/status/1440758396534214658?s=20
+- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
+  - Malicious PowerShell
+  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - HAFNIUM Group
+  - Log4Shell CVE-2021-44228
+  automated_detection_testing: passed
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log
+  impact: 50
   kill_chain_phases:
-  - Exploitation
-  - Lateral Movement
+  - Exfiltration
+  message: PowerShell processes $process$ started with parameters to modify the execution
+    policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$.
   mitre_attack_id:
-  - T1059.001
-  - T1059
+  - T1020
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+  - Splunk Behavioral Analytics
   required_fields:
   - _time
-  security_domain: endpoint
-  impact: 
-  confidence: 
-  # (impact * confidence)/100
-  risk_score: 
-  context:
-  message: 
-  observable:
-  nist:
-  -
-  cis20:
-  -
\ No newline at end of file
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: low
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml b/tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml
index 40e7685175..63b94e6806 100644
--- a/tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml
+++ b/tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml
@@ -2,11 +2,9 @@ name: Windows Powershell Connect to Internet With Hidden Window Unit Test
 tests:
 - name: Windows Powershell Connect to Internet With Hidden Window
   file: endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
+  pass_condition: '@count_gt(0)'
+  description: Test Windows Powershell Connect to Internet With Hidden Window detections
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+    - file_name: hidden_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log
+      source: WinEventLog:Security

From 1cdd6386f3b95c8c8fe65fdffe7e4660bfcdb8b6 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 14 Feb 2022 13:47:06 -0500
Subject: [PATCH 28/42] updating the detection

---
 ...connect_to_internet_with_hidden_window.yml |   5 +-
 ...connect_to_internet_with_hidden_window.yml | 107 ++++++++++++++++++
 2 files changed, 108 insertions(+), 4 deletions(-)
 create mode 100644 dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml

diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index c39f728f26..ea4db54aa5 100644
--- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -15,10 +15,7 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: '| from pulsar("d156ed3a-1254-469a-bffc-9dd6eda97ac6", "persistent://ssa/egress/decorated-events-research") 
-| eval input_event=deserialize_json_object(value) 
-| select input_event 
-| eval _datamodels=ucast(map_get(input_event, "_datamodels"), "collection<string>", []), body={} 
+search: '| from read_ssa_enriched_events()
 | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
new file mode 100644
index 0000000000..d036ed1ec6
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -0,0 +1,107 @@
+author: Jose Hernandez, David Dorsey, Michael Haag Splunk
+datamodel:
+- Endpoint
+date: '2022-02-11'
+description: The following hunting analytic identifies PowerShell commands utilizing
+  the WindowStyle parameter to hide the window on the compromised endpoint. This combination
+  of command-line options is suspicious because it is overriding the default PowerShell
+  execution policy, attempts to hide its activity from the user, and connects to the
+  Internet. Removed in this version of the query is New-Object. The analytic identifies
+  all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter.
+  For example w, win, windowsty and so forth. In addition, through our research it
+  was identified that PowerShell will interpret different command switch types beyond
+  the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: 477e068e-8b6d-11ec-b6c1-81af21670352
+known_false_positives: Legitimate process can have this combination of command-line
+  options, but it's not common.
+name: Windows Powershell Connect to Internet With Hidden Window
+product:
+- Splunk Behavioral Analytics
+references:
+- https://regexr.com/663rr
+- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
+- https://ss64.com/ps/powershell.html
+- https://twitter.com/M_haggis/status/1440758396534214658?s=20
+- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
+risk_message: PowerShell processes $process$ started with parameters to modify the
+  execution policy of the run, run in a hidden window, and connect to the Internet
+  on host $dest$ executed by user $user$.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line,
+  /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval
+  start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
+  - HAFNIUM Group
+  - Log4Shell CVE-2021-44228
+  automated_detection_testing: passed
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exfiltration
+  message: PowerShell processes $process$ started with parameters to modify the execution
+    policy of the run, run in a hidden window, and connect to the Internet on host
+    $dest$ executed by user $user$.
+  mitre_attack_id:
+  - T1020
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: low
+  security_domain: endpoint
+type: Anomaly
+version: 1

From 73cb36c6267cfd1b3476251987e336057c220aae Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 14 Feb 2022 15:54:12 -0500
Subject: [PATCH 29/42] adding working detection

---
 ...ershell_connect_to_internet_with_hidden_window.yml | 11 +++++++++++
 ...l_connect_to_internet_with_hidden_window.test.yml} |  0
 2 files changed, 11 insertions(+)
 rename tests/endpoint/{windows_powershell_connect_to_internet_with_hidden_window.test.yml => ssa___windows_powershell_connect_to_internet_with_hidden_window.test.yml} (100%)

diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index d036ed1ec6..8f641c57c3 100644
--- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -103,5 +103,16 @@ tags:
   risk_score: 35
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Windows Powershell Connect to Internet With Hidden Window Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log
+      file_name: hidden_windows-security.log
+      source: WinEventLog:Security
+    description: Test Windows Powershell Connect to Internet With Hidden Window detections
+    file: endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+    name: Windows Powershell Connect to Internet With Hidden Window
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1
diff --git a/tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml b/tests/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.test.yml
similarity index 100%
rename from tests/endpoint/windows_powershell_connect_to_internet_with_hidden_window.test.yml
rename to tests/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.test.yml

From 1062a0bf93b98bff7e6cb65cb6d641747faeb802 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 14 Feb 2022 14:06:37 -0800
Subject: [PATCH 30/42] duplicates

---
 .../getwmiobject_ds_computer_with_powershell_script_block.yml | 4 ++--
 .../getwmiobject_ds_group_with_powershell_script_block.yml    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
index 85d1f0325e..9c632db1d6 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   parameter leverages WMI to query for all domain computers. Red Teams and adversaries
   may leverage this commandlet to enumerate domain computers for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
-  root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time)
+search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
+  root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_computer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
index 90cb20dc8b..2d3d5d7a09 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams
   and adversaries may leverage this commandlet to enumerate domain groups for situational
   awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
-  root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time)
+search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
+  root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_group_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable

From 3a3d0a99226737786ac9de69beb5a44a8e88b57b Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 14 Feb 2022 21:28:57 -0500
Subject: [PATCH 31/42] adding powershell downloadfile but not passing

---
 .../ssa___windows_powershell_downloadfile.yml |  89 ++++++++++++++
 .../ssa___windows_powershell_downloadfile.yml | 110 ++++++++++++++++++
 ...__windows_powershell_downloadfile.test.yml |  10 ++
 3 files changed, 209 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_powershell_downloadfile.yml
 create mode 100644 dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
 create mode 100644 tests/endpoint/ssa___windows_powershell_downloadfile.test.yml

diff --git a/detections/endpoint/ssa___windows_powershell_downloadfile.yml b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
new file mode 100644
index 0000000000..dcc0421a12
--- /dev/null
+++ b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
@@ -0,0 +1,89 @@
+name: Windows Powershell DownloadFile
+id: 46440222-81d5-44b1-a376-19dcd70d1b08
+version: 1
+date: '2022-02-11'
+author: Jose Hernandez, Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of PowerShell downloading a
+  file using `DownloadFile` method. This particular method is utilized in many different
+  PowerShell frameworks to download files and output to disk. Identify the source
+  (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
+  transaction logs are available, review for further details of the implant.
+search: '| from read_ssa_enriched_events()
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
+| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
+| where (like (cmd_line, "%DownloadFile%"))
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be present and filtering will need to occur
+  by parent process or command line argument. It may be required to modify this query
+  to an EDR product for more granular coverage.
+references:
+- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  - Ingress Tool Transfer
+  - Log4Shell CVE-2021-44228
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:LateralMovement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Lateral Movement
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
+  mitre_attack_id:
+  - T1020
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: low
+  security_domain: endpoint
\ No newline at end of file
diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
new file mode 100644
index 0000000000..b4ee206748
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
@@ -0,0 +1,110 @@
+author: Jose Hernandez, Michael Haag, Splunk
+datamodel:
+- Endpoint
+date: '2022-02-11'
+description: The following analytic identifies the use of PowerShell downloading a
+  file using `DownloadFile` method. This particular method is utilized in many different
+  PowerShell frameworks to download files and output to disk. Identify the source
+  (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
+  transaction logs are available, review for further details of the implant.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 46440222-81d5-44b1-a376-19dcd70d1b08
+known_false_positives: False positives may be present and filtering will need to occur
+  by parent process or command line argument. It may be required to modify this query
+  to an EDR product for more granular coverage.
+name: Windows Powershell DownloadFile
+product:
+- Splunk Behavioral Analytics
+references:
+- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
+  within PowerShell.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%DownloadFile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  - Ingress Tool Transfer
+  - Log4Shell CVE-2021-44228
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:LateralMovement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Lateral Movement
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
+    within PowerShell.
+  mitre_attack_id:
+  - T1020
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Victim
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: parent_process_name
+    role:
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: low
+  security_domain: endpoint
+test:
+  name: Windows Powershell DownloadFile Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log
+      file_name: downloadfile_windows-security.log
+      source: WinEventLog:Security
+    description: Test Windows Powershell DownloadFile  detections
+    file: endpoint/ssa___windows_powershell_downloadfile.yml
+    name: Windows Powershell DownloadFile
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1
diff --git a/tests/endpoint/ssa___windows_powershell_downloadfile.test.yml b/tests/endpoint/ssa___windows_powershell_downloadfile.test.yml
new file mode 100644
index 0000000000..b8276b1001
--- /dev/null
+++ b/tests/endpoint/ssa___windows_powershell_downloadfile.test.yml
@@ -0,0 +1,10 @@
+name: Windows Powershell DownloadFile Unit Test
+tests:
+- name: Windows Powershell DownloadFile 
+  file: endpoint/ssa___windows_powershell_downloadfile.yml
+  pass_condition: '@count_gt(0)'
+  description: Test Windows Powershell DownloadFile  detections
+  attack_data:
+    - file_name: downloadfile_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log
+      source: WinEventLog:Security

From e241241bf234761cc8fe972bac953dbd6ed359f9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Feb 2022 11:09:57 -0700
Subject: [PATCH 32/42] ordinal Data

---
 detections/endpoint/rundll_loading_dll_by_ordinal.yml | 2 +-
 tests/endpoint/rundll_loading_dll_by_ordinal.test.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index 4e2fcc0b6d..fe6f69d903 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -37,7 +37,7 @@ tags:
   - source:endpoint
   - stage: Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon.log
   impact: 70
   kill_chain_phases:
   - Installation
diff --git a/tests/endpoint/rundll_loading_dll_by_ordinal.test.yml b/tests/endpoint/rundll_loading_dll_by_ordinal.test.yml
index cd20cfb719..cd054e156f 100644
--- a/tests/endpoint/rundll_loading_dll_by_ordinal.test.yml
+++ b/tests/endpoint/rundll_loading_dll_by_ordinal.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file

From 085cec0b0dd3a0db526a6970c5b2a9c8759472de Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Feb 2022 10:26:12 -0800
Subject: [PATCH 33/42] adding note

---
 detections/deprecated/detection_of_dns_tunnels.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml
index 5ca1917571..b9da4ebe44 100644
--- a/detections/deprecated/detection_of_dns_tunnels.yml
+++ b/detections/deprecated/detection_of_dns_tunnels.yml
@@ -1,7 +1,7 @@
 name: Detection of DNS Tunnels
 id: 104658f4-afdc-499f-9719-17a43f9826f4
 version: 2
-date: '2017-09-18'
+date: '2022-02-15'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
@@ -12,7 +12,7 @@ description: This search is used to detect DNS tunneling, by calculating the sum
   originating from internal DNS, Web, and Email servers. Endpoints using DNS as a
   method of transmission for data exfiltration, command and control, or evasion of
   security controls can often be detected by noting an unusually large volume of DNS
-  traffic. Deprecated because existing detection is doing the same.
+  traffic. Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.    
 search: '| tstats `security_content_summariesonly` dc("DNS.query") as count  from
   datamodel=Network_Resolution  where nodename=DNS "DNS.message_type"="QUERY" NOT
   (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa"

From e99b973973d7319133f9c3cebff514339de5f0f2 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Feb 2022 10:27:42 -0800
Subject: [PATCH 34/42] note updadte

---
 detections/deprecated/detection_of_dns_tunnels.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml
index b9da4ebe44..e4f375c014 100644
--- a/detections/deprecated/detection_of_dns_tunnels.yml
+++ b/detections/deprecated/detection_of_dns_tunnels.yml
@@ -12,7 +12,10 @@ description: This search is used to detect DNS tunneling, by calculating the sum
   originating from internal DNS, Web, and Email servers. Endpoints using DNS as a
   method of transmission for data exfiltration, command and control, or evasion of
   security controls can often be detected by noting an unusually large volume of DNS
-  traffic. Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.    
+  traffic. \
+
+  NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.   
+   
 search: '| tstats `security_content_summariesonly` dc("DNS.query") as count  from
   datamodel=Network_Resolution  where nodename=DNS "DNS.message_type"="QUERY" NOT
   (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa"

From b42ec08d8580ab5e2043b2c1e8c001ec3f860dd3 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 15 Feb 2022 10:39:23 -0800
Subject: [PATCH 35/42] Fixed spacing on detection_of_dns_tunnels.yml

Added line was too long.
---
 detections/deprecated/detection_of_dns_tunnels.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml
index e4f375c014..218429fef1 100644
--- a/detections/deprecated/detection_of_dns_tunnels.yml
+++ b/detections/deprecated/detection_of_dns_tunnels.yml
@@ -14,7 +14,11 @@ description: This search is used to detect DNS tunneling, by calculating the sum
   security controls can often be detected by noting an unusually large volume of DNS
   traffic. \
 
-  NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.   
+  NOTE:Deprecated because existing detection is doing the same. This detection is 
+  replaced with two other variations, if you are using MLTK then you can use this 
+  search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard 
+  deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, 
+  as an alternantive.   
    
 search: '| tstats `security_content_summariesonly` dc("DNS.query") as count  from
   datamodel=Network_Resolution  where nodename=DNS "DNS.message_type"="QUERY" NOT

From 95d060e135121289dc825798a2dc38d4d16502c5 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Tue, 15 Feb 2022 13:52:01 -0600
Subject: [PATCH 36/42] Character sets are difficult

---
 bin/generate.py                                           | 2 +-
 .../malicious_powershell_process___encoded_command.yml    | 8 ++------
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/bin/generate.py b/bin/generate.py
index bc5d1f9588..6e91a8be2a 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -170,7 +170,7 @@ def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_P
     output_path = path.join(OUTPUT_PATH, 'default/savedsearches.conf')
     output = template.render(detections=detections, time=utc_time)
     with open(output_path, 'w') as f:
-        output = output.encode('ascii', 'ignore').decode('ascii')
+        output = output.encode('utf-8', 'ignore').decode('utf-8')
         f.write(output)
 
     return output_path
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 0b1bb8f3ea..59ea163e8c 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -20,12 +20,8 @@ description: 'The following analytic identifies the use of the EncodedCommand Po
   on admin scripts in use. \
 
   Alternatively, may use regex per matching here https://regexr.com/662ov.'
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
-  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
-  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
-  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
-  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
-  |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
+search: 
+  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,

From c9b8eb298589f13d50dd6c85df3416abaa3e65c4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 15 Feb 2022 13:08:59 -0700
Subject: [PATCH 37/42] rasautou

---
 .../windows_rasautou_dll_execution.yml        | 72 +++++++++++++++++++
 .../windows_rasautou_dll_execution.test.yml   | 12 ++++
 2 files changed, 84 insertions(+)
 create mode 100644 detections/endpoint/windows_rasautou_dll_execution.yml
 create mode 100644 tests/endpoint/windows_rasautou_dll_execution.test.yml

diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml
new file mode 100644
index 0000000000..5cd5622126
--- /dev/null
+++ b/detections/endpoint/windows_rasautou_dll_execution.yml
@@ -0,0 +1,72 @@
+name: Windows Rasautou DLL Execution
+id: 6f42b8be-8e96-11ec-ad5a-acde48001122
+version: 1
+date: '2022-02-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. 
+  During triage, review parent and child process behavior including file and image loads.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_rasautou_dll_execution_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+references:
+  - https://github.com/mandiant/DueDLLigence
+  - https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+  - https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 
+  - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055.001
+  - T1218
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/tests/endpoint/windows_rasautou_dll_execution.test.yml b/tests/endpoint/windows_rasautou_dll_execution.test.yml
new file mode 100644
index 0000000000..034bd707ee
--- /dev/null
+++ b/tests/endpoint/windows_rasautou_dll_execution.test.yml
@@ -0,0 +1,12 @@
+name: Windows Rasautou DLL Execution Unit Test
+tests:
+- name: Windows Rasautou DLL Execution
+  file: endpoint/windows_rasautou_dll_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 7f8e5221c78ef9ac5825205bbd4fcb1a9e034f11 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Tue, 15 Feb 2022 14:17:55 -0600
Subject: [PATCH 38/42] Updated second detection with unicode codepoints

---
 ...owershell___connect_to_internet_with_hidden_window.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
index c6cf21808e..b182cf705a 100644
--- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
@@ -15,12 +15,8 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
-  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
-  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
-  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
-  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
-  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
+search: 
+  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.

From 6ef8187b2f6d7c2a8e0bbe38ea55b2183f91e8fb Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Feb 2022 12:37:57 -0800
Subject: [PATCH 39/42] Update
 ssa___windows_powershell_connect_to_internet_with_hidden_window.yml

---
 ...dows_powershell_connect_to_internet_with_hidden_window.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index ea4db54aa5..b07c391fab 100644
--- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -5,7 +5,7 @@ date: '2022-02-11'
 author: Jose Hernandez, David Dorsey, Michael Haag Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following hunting analytic identifies PowerShell commands utilizing
   the WindowStyle parameter to hide the window on the compromised endpoint. This combination
   of command-line options is suspicious because it is overriding the default PowerShell
@@ -94,4 +94,4 @@ tags:
   - cmd_line
   risk_score: 35
   risk_severity: low
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint

From 990694e9e60af7ac1a333885d0f55f9c951c8bd9 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 15 Feb 2022 12:38:12 -0800
Subject: [PATCH 40/42] Update ssa___windows_powershell_downloadfile.yml

---
 detections/endpoint/ssa___windows_powershell_downloadfile.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___windows_powershell_downloadfile.yml b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
index dcc0421a12..a6391b3bc8 100644
--- a/detections/endpoint/ssa___windows_powershell_downloadfile.yml
+++ b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
@@ -5,7 +5,7 @@ date: '2022-02-11'
 author: Jose Hernandez, Michael Haag, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: The following analytic identifies the use of PowerShell downloading a
   file using `DownloadFile` method. This particular method is utilized in many different
   PowerShell frameworks to download files and output to disk. Identify the source
@@ -86,4 +86,4 @@ tags:
   - cmd_line
   risk_score: 35
   risk_severity: low
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint

From b767a93e5b86c25072c0f8199d53a215622f7893 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Tue, 15 Feb 2022 17:40:51 -0500
Subject: [PATCH 41/42] fixing base on feedback

---
 detections/endpoint/ssa___windows_powershell_downloadfile.yml | 2 +-
 dist/ssa/srs/ssa___windows_powershell_downloadfile.yml        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___windows_powershell_downloadfile.yml b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
index dcc0421a12..295399d429 100644
--- a/detections/endpoint/ssa___windows_powershell_downloadfile.yml
+++ b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
@@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events()
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
 | where cmd_line IS NOT NULL AND process_name IS NOT NULL 
 | where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
-| where (like (cmd_line, "%DownloadFile%"))
+| where (like (cmd_line, "%downloadfile%"))
 | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
 | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
index b4ee206748..1799870fc0 100644
--- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
@@ -35,7 +35,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
   OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
   OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
-  (cmd_line, "%DownloadFile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name, "process_path", process_path])

From 5c8268f137f22be3fb02027ef565e818b0fd9a89 Mon Sep 17 00:00:00 2001
From: research bot <research@splunk.com>
Date: Tue, 15 Feb 2022 23:10:10 +0000
Subject: [PATCH 42/42] updating docs and package bits [ci skip]

---
 .../deprecated/detection_of_dns_tunnels.yml   |     14 +-
 ...load_with_urlcache_and_split_arguments.yml |      8 +-
 ...oad_with_verifyctl_and_split_arguments.yml |      8 +-
 ...s_powershell_process___encoded_command.yml |      8 +-
 ...connect_to_internet_with_hidden_window.yml |      8 +-
 .../rundll_loading_dll_by_ordinal.yml         |     25 +-
 ...connect_to_internet_with_hidden_window.yml |     23 +-
 .../ssa___windows_powershell_downloadfile.yml |     23 +-
 .../windows_rasautou_dll_execution.yml        |     88 +-
 ...ows_remote_assistance_spawning_process.yml |     84 +-
 .../windows_schtasks_create_run_as_system.yml |     93 +-
 ...l_volume_download_from_internal_server.yml |     85 +-
 dist/escu/app.manifest                        |      2 +-
 dist/escu/default/analyticstories.conf        |     49 +-
 dist/escu/default/app.conf                    |      4 +-
 dist/escu/default/collections.conf            |      2 +-
 dist/escu/default/content-version.conf        |      2 +-
 dist/escu/default/es_investigations.conf      |      2 +-
 dist/escu/default/macros.conf                 |     14 +-
 dist/escu/default/savedsearches.conf          |    197 +-
 dist/escu/default/transforms.conf             |      2 +-
 ...connect_to_internet_with_hidden_window.yml |      2 +-
 .../ssa___windows_powershell_downloadfile.yml |      2 +-
 docs/_pages/adversary_tactics.md              |     14 +-
 docs/_pages/detections.md                     |     13 +-
 docs/_pages/stories.md                        |     14 +-
 docs/_playbooks/delete_detected_files.md      |      7 +
 docs/_playbooks/log4j_investigate.md          |     63 +
 docs/_playbooks/log4j_respond.md              |     63 +
 .../ransomware_investigate_and_contain.md     |      7 +
 ...t_ds_group_with_powershell_script_block.md |      2 +-
 ...s_computer_with_powershell_script_block.md |      2 +-
 ...-08-disable_defender_antivirus_registry.md |      4 +-
 ...ownload_from_internal_server_per_entity.md |    122 +
 ...load_with_urlcache_and_split_arguments.md} |      8 +-
 ...oad_with_verifyctl_and_split_arguments.md} |      8 +-
 ...dows_remote_assistance_spawning_process.md |    115 +
 ...7-windows_schtasks_create_run_as_system.md |    124 +
 ...022-02-08-rundll_loading_dll_by_ordinal.md |    120 +
 ..._connect_to_internet_with_hidden_window.md |    118 +
 ...2-02-11-windows_powershell_downloadfile.md |    111 +
 ...22-02-15-windows_rasautou_dll_execution.md |    126 +
 docs/_stories/credential_dumping.md           |      2 +-
 docs/_stories/hafnium_group.md                |      4 +-
 docs/_stories/ingress_tool_transfer.md        |      1 +
 docs/_stories/log4shell_cve-2021-44228.md     |      5 +-
 docs/_stories/malicious_powershell.md         |      5 +-
 ...ciated_with_mudcarp_espionage_campaigns.md |      4 +-
 docs/_stories/suspicious_rundll32_activity.md |      1 +
 docs/_stories/unusual_processes.md            |      2 +
 .../windows_defense_evasion_tactics.md        |      3 +-
 .../windows_persistence_techniques.md         |      3 +-
 docs/index.markdown                           |      4 +-
 docs/mitre-map/coverage.csv                   | 152358 ++++++++-------
 docs/mitre-map/coverage.json                  |  12888 +-
 55 files changed, 85282 insertions(+), 81784 deletions(-)
 create mode 100644 docs/_posts/2022-01-17-unusual_volume_of_data_download_from_internal_server_per_entity.md
 rename docs/_posts/{2021-03-23-certutil_download_with_urlcache_and_split_arguments.md => 2022-02-03-certutil_download_with_urlcache_and_split_arguments.md} (92%)
 rename docs/_posts/{2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md => 2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md} (93%)
 create mode 100644 docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
 create mode 100644 docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
 create mode 100644 docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
 create mode 100644 docs/_posts/2022-02-11-windows_powershell_connect_to_internet_with_hidden_window.md
 create mode 100644 docs/_posts/2022-02-11-windows_powershell_downloadfile.md
 create mode 100644 docs/_posts/2022-02-15-windows_rasautou_dll_execution.md

diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml
index 218429fef1..21bfff382e 100644
--- a/detections/deprecated/detection_of_dns_tunnels.yml
+++ b/detections/deprecated/detection_of_dns_tunnels.yml
@@ -6,20 +6,18 @@ author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
 - Network_Resolution
-description: This search is used to detect DNS tunneling, by calculating the sum of
-  the length of DNS queries and DNS answers. The search also filters out potential
+description: 'This search is used to detect DNS tunneling, by calculating the sum
+  of the length of DNS queries and DNS answers. The search also filters out potential
   false positives by filtering out queries made to internal systems and the queries
   originating from internal DNS, Web, and Email servers. Endpoints using DNS as a
   method of transmission for data exfiltration, command and control, or evasion of
   security controls can often be detected by noting an unusually large volume of DNS
   traffic. \
 
-  NOTE:Deprecated because existing detection is doing the same. This detection is 
-  replaced with two other variations, if you are using MLTK then you can use this 
-  search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard 
-  deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, 
-  as an alternantive.   
-   
+  NOTE:Deprecated because existing detection is doing the same. This detection is
+  replaced with two other variations, if you are using MLTK then you can use this
+  search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation
+  version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.'
 search: '| tstats `security_content_summariesonly` dc("DNS.query") as count  from
   datamodel=Network_Resolution  where nodename=DNS "DNS.message_type"="QUERY" NOT
   (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa"
diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 20168a30e2..34dd2735d6 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -15,10 +15,10 @@ description: Certutil.exe may download a file from a remote destination using `-
   remote IP or domain in question.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
-  Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.original_file_name
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
+  Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index 65fef131a1..1a61ded17f 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -15,10 +15,10 @@ description: 'Certutil.exe may download a file from a remote destination using `
   written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
-  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
+  Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user
+  Processes.original_file_name Processes.parent_process Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 59ea163e8c..0b1bb8f3ea 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -20,8 +20,12 @@ description: 'The following analytic identifies the use of the EncodedCommand Po
   on admin scripts in use. \
 
   Alternatively, may use regex per matching here https://regexr.com/662ov.'
-search: 
-  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
+search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
+  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
+  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
+  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
+  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
+  |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
index b182cf705a..c6cf21808e 100644
--- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
@@ -15,8 +15,12 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: 
-  "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
+search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
+  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
+  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
+  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
+  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
+  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index fe6f69d903..39ea9b205b 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -6,24 +6,29 @@ author: Michael Haag, David Dorsey, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may
-  abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice
-  executing directly, may avoid triggering security tools that may not monitor execution
-  of the rundll32.exe process because of allowlists or false positives from normal
-  operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
+description: The following analytic identifies rundll32.exe loading an export function
+  by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious
+  code. Using rundll32.exe, vice executing directly, may avoid triggering security
+  tools that may not monitor execution of the rundll32.exe process because of allowlists
+  or false positives from normal operations. Utilizing ordinal values makes it a bit
+  more complicated for analysts to understand the behavior until the DLL is reviewed.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-    Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") | `rundll_loading_dll_by_ordinal_filter`'
+  where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") |
+  `rundll_loading_dll_by_ordinal_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
+known_false_positives: False positives are possible with native utilities and third
+  party applications. Filtering may be needed based on command-line, or add world
+  writeable paths to restrict query.
 references:
-  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ 
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Unusual Processes
diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index b07c391fab..8c4e9e2a4f 100644
--- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -15,17 +15,21 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: '| from read_ssa_enriched_events()
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
-| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
-| where match_regex(cmd_line, /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true 
-| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
-| into write_ssa_detected_events();'
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line,
+  /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval
+  start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -58,7 +62,8 @@ tags:
   kill_chain_phases:
   - Exfiltration
   message: PowerShell processes $process$ started with parameters to modify the execution
-    policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$.
+    policy of the run, run in a hidden window, and connect to the Internet on host
+    $dest$ executed by user $user$.
   mitre_attack_id:
   - T1020
   nist:
diff --git a/detections/endpoint/ssa___windows_powershell_downloadfile.yml b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
index 9708f9299e..939778867e 100644
--- a/detections/endpoint/ssa___windows_powershell_downloadfile.yml
+++ b/detections/endpoint/ssa___windows_powershell_downloadfile.yml
@@ -11,17 +11,20 @@ description: The following analytic identifies the use of PowerShell downloading
   PowerShell frameworks to download files and output to disk. Identify the source
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
-search: '| from read_ssa_enriched_events()
-| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
-| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe"
-| where (like (cmd_line, "%downloadfile%"))
-| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
-| into write_ssa_detected_events();'
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe"
+  OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe"
+  OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like
+  (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -50,7 +53,9 @@ tags:
   impact: 50
   kill_chain_phases:
   - Lateral Movement
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
+    within PowerShell.
   mitre_attack_id:
   - T1020
   nist:
diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml
index 5cd5622126..1478210a41 100644
--- a/detections/endpoint/windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/windows_rasautou_dll_execution.yml
@@ -6,57 +6,46 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. 
-  During triage, review parent and child process behavior including file and image loads.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `windows_rasautou_dll_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+description: The following analytic identifies the Windows Windows Remote Auto Dialer,
+  rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
+  shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
+  parent and child process behavior including file and image loads.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe
+  Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rasautou_dll_execution_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives will be limited to applications that require
+  Rasautou.exe to load a DLL from disk. Filter as needed.
 references:
-  - https://github.com/mandiant/DueDLLigence
-  - https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
-  - https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513 
-  - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
+- https://github.com/mandiant/DueDLLigence
+- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
+- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log
+  impact: 80
   kill_chain_phases:
   - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ attempting to load a DLL in a suspicious manner.
   mitre_attack_id:
   - T1055.001
   - T1218
   - T1055
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
   observable:
   - name: dest
     type: Hostname
@@ -69,4 +58,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml
index 55a49c7865..723eeca63c 100644
--- a/detections/endpoint/windows_remote_assistance_spawning_process.yml
+++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml
@@ -6,54 +6,43 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected.
-  This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+description: The following analytic identifies the use of Microsoft Remote Assistance,
+  msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default
+  has no command-line arguments and typically spawns itself. It will generate a network
+  connection to the remote system that is connected. This behavior is indicative of
+  another process injected into msra.exe. Review the parent process or cross process
+  events to identify source.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe
-  `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
+  `windows_shells` by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives should be limited, filter as needed. Add additional shells as needed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited, filter as needed. Add additional
+  shells as needed.
 references:
-  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Unusual Processes
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1055
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
   confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$, generating behavior not common with msra.exe.
+  mitre_attack_id:
+  - T1055
   observable:
   - name: dest
     type: Hostname
@@ -66,4 +55,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml
index c7fff79e68..aa37903127 100644
--- a/detections/endpoint/windows_schtasks_create_run_as_system.yml
+++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml
@@ -6,58 +6,44 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. 
-  This is commonly used by adversaries to spawn a process in an elevated state. 
+description: The following analytic identifies Schtasks.exe creating a new task to
+  start and run as an elevated user - SYSTEM. This is commonly used by adversaries
+  to spawn a process in an elevated state.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_schtasks`
-  Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_schtasks_create_run_as_system_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+  as lastTime from datamodel=Endpoint.Processes where `process_schtasks` Processes.process="*/create
+  *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives will be limited to legitimate applications
+  creating a task to run as SYSTEM. Filter as needed based on parent process, or modify
+  the query to have world writeable paths to restrict it.
 references:
-  - https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
-  - https://www.ired.team/offensive-security/persistence/t1053-schtask
-  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
+- https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
+- https://www.ired.team/offensive-security/persistence/t1053-schtask
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Windows Persistence Techniques
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1053.005
-  - T1053
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
   confidence: 60
-  # (impact * confidence)/100
-  risk_score: 48
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An $process_name$ was created on endpoint $dest$ attempting to spawn as
+    SYSTEM.
+  mitre_attack_id:
+  - T1053.005
+  - T1053
   observable:
   - name: dest
     type: Hostname
@@ -66,4 +52,23 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 48
+  security_domain: endpoint
diff --git a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
index e87ce92d78..d0260a789b 100644
--- a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
+++ b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml
@@ -6,47 +6,59 @@ author: Xiao Lin, Splunk
 type: Anomaly
 datamodel:
 - Network_Traffic
-description: Insider might conduct information collection before data exfiltration, and unusual volume of data
-  download from internal server is an indicator of such potential threat. This detection evaluates the total 
-  bytes downloaded from internal servers at specific time window per entity level, and then flagged these that 
-  are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte 
-  volume is unusual even though that operation is benigh, which causes false positive. It is therefore advised 
-  to adjust threshold and time window based on detection performance whenever necessary. It should be noted that 
-  seasonality is not modeled in the current approach.
-search: '| from read_ssa_enriched_events() 
-  | eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null)
-  | eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null))
-  | where sourcetype == "pan:traffic"
-  | eval src_device_scope = map_get(input_event, "src_device_scope")
-  | eval dest_device_scope = map_get(input_event, "src_device_scope")
-  | where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL
-  | eval dest_device = map_get(input_event, "dest_device_ips")
-  | where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL"
-  | eval src_device = map_get(input_event, "source_device_ips")
-  | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
-  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string", null))
-  | where download_bytes IS NOT NULL
-  | eval tenant = map_get(input_event, "_tenant"), event_id = map_get(input_event, "event_id")
-  | adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" threshold=0.001 window=86400L
-  | eval end_time = timestamp
-  | eval start_time = end_time - 86400
-  | eval body = create_map(["event_id", event_id, "tenant", tenant])
-  | select start_time, end_time, dest_device, label, body
-  | into write_ssa_detected_events();'
-how_to_implement: Ingest PAN traffic logs 
-known_false_positives: Benign large volume data download might be flagged as (false) positive.
+description: Insider might conduct information collection before data exfiltration,
+  and unusual volume of data download from internal server is an indicator of such
+  potential threat. This detection evaluates the total bytes downloaded from internal
+  servers at specific time window per entity level, and then flagged these that are
+  higher than 99.999% percentile as an anamaly. A behavior will be reported as long
+  as the downloaded byte volume is unusual even though that operation is benigh, which
+  causes false positive. It is therefore advised to adjust threshold and time window
+  based on detection performance whenever necessary. It should be noted that seasonality
+  is not modeled in the current approach.
+search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event,
+  "sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope
+  = map_get(input_event, "src_device_scope") | eval dest_device_scope = map_get(input_event,
+  "src_device_scope") | where src_device_scope IS NOT NULL AND dest_device_scope IS
+  NOT NULL | eval dest_device = map_get(input_event, "dest_device_ips") | where dest_device
+  IS NOT NULL AND dest_device_scope == "INTERNAL" | eval src_device = map_get(input_event,
+  "source_device_ips") | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
+  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string",
+  null)) | where download_bytes IS NOT NULL | eval tenant = map_get(input_event, "_tenant"),
+  event_id = map_get(input_event, "event_id") | adaptive_threshold algorithm="quantile"
+  value="download_bytes" entity="dest_device" threshold=0.001 window=86400L | eval
+  end_time = timestamp | eval start_time = end_time - 86400 | eval body = create_map(["event_id",
+  event_id, "tenant", tenant]) | select start_time, end_time, dest_device, label,
+  body | into write_ssa_detected_events();'
+how_to_implement: Ingest PAN traffic logs
+known_false_positives: Benign large volume data download might be flagged as (false)
+  positive.
 references:
 - https://github.com/twitter/AnomalyDetection
 tags:
   analytic_story:
   - Insider Threat
+  cis20:
+  - CIS 13
+  confidence: 50
+  context: null
   dataset:
   - https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
+  impact: 50
   kill_chain_phases:
   - Weaponization
+  message: $src_device_ip downloaded unusually amount of data from internal server
+    within one day
   mitre_attack_id:
   - T1213
   - T1039
+  nist:
+  - DE.AE
+  observable:
+  - name: src_device_ip
+    type: Host IP
+    role:
+    - Others
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -54,19 +66,6 @@ tags:
   - dest_device_scope
   - bytes_in
   - src_device_ips
-  security_domain: network
-  impact: 50
-  confidence: 50
   risk_score: 25
   risk_severity: low
-  context:
-  message: $src_device_ip downloaded unusually amount of data from internal server within one day
-  observable:
-    - name: src_device_ip
-      type: Host IP
-      role:
-      - Others
-  nist:
-  - DE.AE
-  cis20:
-  - CIS 13
+  security_domain: network
diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index 77badffaea..f920f70d44 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.34.3"
+      "version": "3.35.0"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index 4797263b7c..0dcfbf8f44 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:30 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -625,7 +625,7 @@ references = ["https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injectio
 maintainers = [{"company": "no", "email": "-", "name": "Jose Hernandez"}]
 spec_version = 3
 searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Curl Download and Bash Execution - Rule", "ESCU - Detect Outbound LDAP Traffic - Rule", "ESCU - Hunting for Log4Shell - Rule", "ESCU - Java Class File download by Java User Agent - Rule", "ESCU - Linux Java Spawning Shell - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule", "ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule", "ESCU - Outbound Network Connection from Java Using Default Ports - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Wget Download and Bash Execution - Rule", "ESCU - Windows Java Spawning Shells - Rule"]
-description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' 
+description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Respond', 'Log4j Splunk Investigation' 
 narrative = In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called ["A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land"](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf). Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system.
 
 [analytic_story://Malicious PowerShell]
@@ -1192,7 +1192,7 @@ version = 1
 references = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"]
+searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"]
 description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.
 narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code.
 
@@ -1286,7 +1286,7 @@ version = 2
 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Verclsid CLSID Execution - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Verclsid CLSID Execution - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Remote Assistance Spawning Process - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\
 This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\
@@ -1332,7 +1332,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
@@ -1370,7 +1370,7 @@ version = 2
 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.
 
@@ -3662,7 +3662,8 @@ providing_technologies = []
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
+NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
 how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]}
 known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment.
@@ -7607,10 +7608,10 @@ providing_technologies = []
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
+explanation = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
-known_false_positives = While not common, loading a DLL under %AppData% and calling a function by ordinal is possible by a legitimate process
+known_false_positives = False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
 providing_technologies = []
 
 [savedsearch://ESCU - Runas Execution in CommandLine - Rule]
@@ -9399,6 +9400,36 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00
 known_false_positives = False positives should be limited, however filter as needed.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Rasautou DLL Execution - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1218", "T1055"]}
+known_false_positives = False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Remote Assistance Spawning Process - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
+known_false_positives = False positives should be limited, filter as needed. Add additional shells as needed.
+providing_technologies = []
+
+[savedsearch://ESCU - Windows Schtasks Create Run As System - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"]}
+known_false_positives = False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Security Account Manager Stopped - Rule]
 type = detection
 asset_type = Endpoint
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 7dfa3fcb68..36304c7868 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 5113
+build = 5376
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.34.3
+version = 3.35.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index bb7a1bff0b..c66818a536 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:30 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index 907ca68e8e..35fcb9a892 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.34.3
+version = 3.35.0
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index 3760d30279..a0582ff2da 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -337,7 +337,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
 [panel_group://workbench_panel_group_log4shell_cve_2021_44228]
 label = Log4Shell CVE-2021-44228
-description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Splunk Investigation', 'Log4j Respond' 
+description = Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Log4j Investigate', 'Log4j Respond', 'Log4j Splunk Investigation' 
 disabled = 0
 
 panels = ["panel://workbench_panel_get_notable_history___response_task"]
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index ca2355c816..1973581e1b 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:30 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -4071,6 +4071,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_rasautou_dll_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_remote_assistance_spawning_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_schtasks_create_run_as_system_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_security_account_manager_stopped_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index c1d6f25968..3ffe4532d0 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:29 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -2953,8 +2953,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
-action.escu.creation_date = 2021-03-23
-action.escu.modification_date = 2021-03-23
+action.escu.creation_date = 2022-02-03
+action.escu.modification_date = 2022-02-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - CertUtil Download With URLCache and Split Arguments - Rule
 action.escu.search_type = detection
@@ -2988,7 +2988,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`
 
 [ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule]
 action.escu = 0
@@ -2999,8 +2999,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. 
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
-action.escu.creation_date = 2021-03-23
-action.escu.modification_date = 2021-03-23
+action.escu.creation_date = 2022-02-03
+action.escu.modification_date = 2022-02-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule
 action.escu.search_type = detection
@@ -3034,7 +3034,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl* Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`
 
 [ESCU - CertUtil With Decode Argument - Rule]
 action.escu = 0
@@ -9542,14 +9542,16 @@ search = | tstats `security_content_summariesonly` count values(Web.url) as url
 [ESCU - Detection of DNS Tunnels - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
+NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
 action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]}
 action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
+NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
 action.escu.how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue.
 action.escu.known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment.
-action.escu.creation_date = 2017-09-18
-action.escu.modification_date = 2017-09-18
+action.escu.creation_date = 2022-02-15
+action.escu.modification_date = 2022-02-15
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detection of DNS Tunnels - Rule
 action.escu.search_type = detection
@@ -9565,7 +9567,8 @@ action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "S
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = ['src']
-action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. \
+NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
 action.notable.param.rule_title = Detection of DNS Tunnels
 action.notable.param.security_domain = network
 action.notable.param.severity = high
@@ -15653,7 +15656,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`
 
 [ESCU - GetWmiObject Ds Group with PowerShell - Rule]
 action.escu = 0
@@ -15744,7 +15747,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`
 
 [ESCU - GetWmiObject User Account with PowerShell - Rule]
 action.escu = 0
@@ -20330,7 +20333,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|||]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") | `malicious_powershell_process___encoded_command_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|–|—|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") | `malicious_powershell_process___encoded_command_filter`
 
 [ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule]
 action.escu = 0
@@ -23898,7 +23901,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|||]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") | `powershell___connect_to_internet_with_hidden_window_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|–|—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") | `powershell___connect_to_internet_with_hidden_window_filter`
 
 [ESCU - PowerShell 4104 Hunting - Rule]
 action.escu = 0
@@ -26984,35 +26987,35 @@ search = | tstats `security_content_summariesonly` count  FROM datamodel=Endpoin
 [ESCU - RunDLL Loading DLL By Ordinal - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
+description = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
+action.escu.eli5 = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-action.escu.known_false_positives = While not common, loading a DLL under %AppData% and calling a function by ordinal is possible by a legitimate process
-action.escu.creation_date = 2020-11-30
-action.escu.modification_date = 2020-11-30
+action.escu.known_false_positives = False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
+action.escu.creation_date = 2022-02-08
+action.escu.modification_date = 2022-02-08
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - RunDLL Loading DLL By Ordinal - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Unusual Processes"]
+action.escu.analytic_story = ["Unusual Processes", "Suspicious Rundll32 Activity"]
 action.risk = 1
-action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
+action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Deprecated - RunDLL Loading DLL By Ordinal - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]}
+action.correlationsearch.label = ESCU - RunDLL Loading DLL By Ordinal - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes", "Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = ['user', 'dest']
-action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
+action.notable.param.rule_description = The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
 action.notable.param.rule_title = RunDLL Loading DLL By Ordinal
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -27025,7 +27028,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter`
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") | `rundll_loading_dll_by_ordinal_filter`
 
 [ESCU - Runas Execution in CommandLine - Rule]
 action.escu = 0
@@ -34906,6 +34909,144 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`
 
+[ESCU - Windows Rasautou DLL Execution - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1218", "T1055"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+action.escu.creation_date = 2022-02-15
+action.escu.modification_date = 2022-02-15
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Rasautou DLL Execution - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Rasautou DLL Execution - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1218", "T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+action.notable.param.rule_title = Windows Rasautou DLL Execution
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rasautou_dll_execution_filter`
+
+[ESCU - Windows Remote Assistance Spawning Process - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives should be limited, filter as needed. Add additional shells as needed.
+action.escu.creation_date = 2022-02-07
+action.escu.modification_date = 2022-02-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Assistance Spawning Process - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Unusual Processes"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Assistance Spawning Process - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+action.notable.param.rule_title = Windows Remote Assistance Spawning Process
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`
+
+[ESCU - Windows Schtasks Create Run As System - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+action.escu.creation_date = 2022-02-07
+action.escu.modification_date = 2022-02-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Schtasks Create Run As System - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Windows Persistence Techniques"]
+action.risk = 1
+action.risk.param._risk_message = An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Schtasks Create Run As System - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+action.notable.param.rule_title = Windows Schtasks Create Run As System
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_schtasks` Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`
+
 [ESCU - Windows Security Account Manager Stopped - Rule]
 action.escu = 0
 action.escu.enabled = 1
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 8221c34b7c..a89212e058 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-02-07T20:56:29 UTC
+# On Date: 2022-02-15T23:04:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index 8f641c57c3..2ad587f434 100644
--- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -1,6 +1,6 @@
 author: Jose Hernandez, David Dorsey, Michael Haag Splunk
 datamodel:
-- Endpoint
+- Endpoint_Processes
 date: '2022-02-11'
 description: The following hunting analytic identifies PowerShell commands utilizing
   the WindowStyle parameter to hide the window on the compromised endpoint. This combination
diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
index 1799870fc0..88e821cb25 100644
--- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
@@ -1,6 +1,6 @@
 author: Jose Hernandez, Michael Haag, Splunk
 datamodel:
-- Endpoint
+- Endpoint_Processes
 date: '2022-02-11'
 description: The following analytic identifies the use of PowerShell downloading a
   file using `DownloadFile` method. This particular method is utilized in many different
diff --git a/docs/_pages/adversary_tactics.md b/docs/_pages/adversary_tactics.md
index 6a9d33dae5..72d14631ec 100644
--- a/docs/_pages/adversary_tactics.md
+++ b/docs/_pages/adversary_tactics.md
@@ -26,18 +26,18 @@ sidebar:
 | [Disabling Security Tools](/stories/disabling_security_tools/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
 | [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [HAFNIUM Group](/stories/hafnium_group/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
-| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
+| [HAFNIUM Group](/stories/hafnium_group/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
+| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Linux Persistence Techniques](/stories/linux_persistence_techniques/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Linux Privilege Escalation](/stories/linux_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [Malicious PowerShell](/stories/malicious_powershell/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
+| [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
+| [Malicious PowerShell](/stories/malicious_powershell/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](/stories/meterpreter/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
 | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [NOBELIUM Group](/stories/nobelium_group/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
-| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
+| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [ProxyShell](/stories/proxyshell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
 | [SQL Injection](/stories/sql_injection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
 | [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) |
@@ -58,8 +58,8 @@ sidebar:
 | [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) |
 | [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
 | [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
\ No newline at end of file
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index cb94713d5c..3ae678ceae 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -61,8 +61,8 @@ sidebar:
 | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
@@ -218,7 +218,7 @@ sidebar:
 | [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | TTP |
 | [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender AntiVirus Registry](/endpoint/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Disable Defender AntiVirus Registry](/experimental/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Disable Defender AntiVirus Registry](/endpoint/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender BlockAtFirstSeen Feature](/endpoint/disable_defender_blockatfirstseen_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender Enhanced Notification](/endpoint/disable_defender_enhanced_notification/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Defender MpEngine Registry](/endpoint/disable_defender_mpengine_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
@@ -357,8 +357,8 @@ sidebar:
 | [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly |
 | [Gsuite suspicious calendar invite](/cloud/gsuite_suspicious_calendar_invite/) | [Phishing](/tags/#phishing) | Hunting |
 | [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | Anomaly |
@@ -574,6 +574,7 @@ sidebar:
 | [Resize Shadowstorage Volume](/endpoint/resize_shadowstorage_volume/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP |
 | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | TTP |
+| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Runas Execution in CommandLine](/endpoint/runas_execution_in_commandline/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft) | Hunting |
 | [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | Hunting |
 | [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
@@ -687,6 +688,7 @@ sidebar:
 | [Unusual LOLBAS in short period of time](/endpoint/unusual_lolbas_in_short_period_of_time/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [Unusual Number of Computer Service Tickets Requested](/endpoint/unusual_number_of_computer_service_tickets_requested/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
 | [Unusual Number of Remote Endpoint Authentication Events](/endpoint/unusual_number_of_remote_endpoint_authentication_events/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
+| [Unusual Volume of Data Download from Internal Server Per Entity](/network/unusual_volume_of_data_download_from_internal_server_per_entity/) | [Data from Information Repositories](/tags/#data-from-information-repositories), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | Anomaly |
 | [Unusually Long Command Line]() | None | Anomaly |
 | [Unusually Long Command Line - MLTK]() | None | Anomaly |
 | [Unusually Long Content-Type Length]() | None | Anomaly |
@@ -737,7 +739,12 @@ sidebar:
 | [Windows NirSoft Utilities](/endpoint/windows_nirsoft_utilities/) | [Tool](/tags/#tool) | Hunting |
 | [Windows Non-System Account Targeting Lsass](/endpoint/windows_non-system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Windows Possible Credential Dumping](/endpoint/windows_possible_credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
+| [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 | [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP |
+| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | TTP |
+| [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection) | TTP |
+| [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Windows Service Created With Suspicious Service Path](/endpoint/windows_service_created_with_suspicious_service_path/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP |
 | [Windows Service Created Within Public Path](/endpoint/windows_service_created_within_public_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md
index 6cb21c61dd..d9725d5fc1 100644
--- a/docs/_pages/stories.md
+++ b/docs/_pages/stories.md
@@ -49,18 +49,18 @@ sidebar:
 | [F5 TMUI RCE CVE-2020-5902](f5_tmui_rce_cve-2020-5902) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
 | [FIN7](fin7) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
 | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
-| [HAFNIUM Group](hafnium_group) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
+| [HAFNIUM Group](hafnium_group) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) |
 | [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
 | [Information Sabotage](information_sabotage) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Impact](/tags/#impact) |
-| [Ingress Tool Transfer](ingress_tool_transfer) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
+| [Ingress Tool Transfer](ingress_tool_transfer) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
 | [Linux Persistence Techniques](linux_persistence_techniques) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Linux Privilege Escalation](linux_privilege_escalation) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [Malicious PowerShell](malicious_powershell) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
+| [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
+| [Malicious PowerShell](malicious_powershell) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](meterpreter) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
 | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
@@ -70,7 +70,7 @@ sidebar:
 | [Office 365 Detections](office_365_detections) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | [Collection](/tags/#collection) |
 | [Orangeworm Attack Group](orangeworm_attack_group) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
-| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
+| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) |
 | [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
 | [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
@@ -112,11 +112,11 @@ sidebar:
 | [Use of Cleartext Protocols]() | None | None |
 | [WhisperGate](whispergate) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows Log Manipulation](windows_log_manipulation) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
 | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
 | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
 | [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
diff --git a/docs/_playbooks/delete_detected_files.md b/docs/_playbooks/delete_detected_files.md
index a8e87a9108..85c316de0a 100644
--- a/docs/_playbooks/delete_detected_files.md
+++ b/docs/_playbooks/delete_detected_files.md
@@ -768,6 +768,13 @@ This playbook acts upon events where a file has been determined to be malicious
 
 
 
+
+
+
+
+
+
+
 
 
 
diff --git a/docs/_playbooks/log4j_investigate.md b/docs/_playbooks/log4j_investigate.md
index 78edf26f80..6b2213464f 100644
--- a/docs/_playbooks/log4j_investigate.md
+++ b/docs/_playbooks/log4j_investigate.md
@@ -1464,6 +1464,15 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
+
+
 
 
 
@@ -1903,6 +1912,11 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
 
 
 
@@ -3372,6 +3386,20 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -4252,6 +4280,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -4927,6 +4962,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -5679,6 +5721,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -6176,6 +6225,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -6775,6 +6831,13 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
+
 
 
 
diff --git a/docs/_playbooks/log4j_respond.md b/docs/_playbooks/log4j_respond.md
index f8c67f79b8..a5da0306dc 100644
--- a/docs/_playbooks/log4j_respond.md
+++ b/docs/_playbooks/log4j_respond.md
@@ -1464,6 +1464,15 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
+
+
 
 
 
@@ -1903,6 +1912,11 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
 
 
 
@@ -3372,6 +3386,20 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -4252,6 +4280,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -4927,6 +4962,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -5679,6 +5721,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -6176,6 +6225,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
@@ -6775,6 +6831,13 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
+
 
 
 
diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md
index fa7b2d2847..47801c8dcc 100644
--- a/docs/_playbooks/ransomware_investigate_and_contain.md
+++ b/docs/_playbooks/ransomware_investigate_and_contain.md
@@ -773,6 +773,13 @@ This playbook investigates and contains ransomware detected on endpoints.
 
 
 
+
+
+
+
+
+
+
 
 
 
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
index 0e6aa72098..2f63b5c62b 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
@@ -43,7 +43,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 #### Search
 
 ```
-`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) 
+`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_group*") 
 | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
 | `security_content_ctime(firstTime)` 
 | `getwmiobject_ds_group_with_powershell_script_block_filter`
diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
index 4aa3b5b543..fe86ffa34a 100644
--- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
@@ -39,7 +39,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 #### Search
 
 ```
-`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_computer"*) 
+`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_computer*") 
 | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
 | `security_content_ctime(firstTime)` 
 | `getwmiobject_ds_computer_with_powershell_script_block_filter`
diff --git a/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md b/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
index 3b4c5cea0f..3511f37a66 100644
--- a/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
+++ b/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
@@ -2,7 +2,7 @@
 title: "Disable Defender AntiVirus Registry"
 excerpt: "Disable or Modify Tools, Impair Defenses"
 categories:
-  - Experimental
+  - Endpoint
 last_modified_at: 2021-12-08
 toc: true
 toc_label: ""
@@ -107,4 +107,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/experimental/disable_defender_antivirus_registry.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/disable_defender_antivirus_registry.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-01-17-unusual_volume_of_data_download_from_internal_server_per_entity.md b/docs/_posts/2022-01-17-unusual_volume_of_data_download_from_internal_server_per_entity.md
new file mode 100644
index 0000000000..144f0b10b8
--- /dev/null
+++ b/docs/_posts/2022-01-17-unusual_volume_of_data_download_from_internal_server_per_entity.md
@@ -0,0 +1,122 @@
+---
+title: "Unusual Volume of Data Download from Internal Server Per Entity"
+excerpt: "Data from Information Repositories, Data from Network Shared Drive"
+categories:
+  - Network
+last_modified_at: 2022-01-17
+toc: true
+toc_label: ""
+tags:
+  - Data from Information Repositories
+  - Collection
+  - Data from Network Shared Drive
+  - Collection
+  - Splunk Behavioral Analytics
+  - Network_Traffic
+---
+
+### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Insider might conduct information collection before data exfiltration, and unusual volume of data download from internal server is an indicator of such potential threat. This detection evaluates the total bytes downloaded from internal servers at specific time window per entity level, and then flagged these that are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte volume is unusual even though that operation is benigh, which causes false positive. It is therefore advised to adjust threshold and time window based on detection performance whenever necessary. It should be noted that seasonality is not modeled in the current approach.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
+- **Last Updated**: 2022-01-17
+- **Author**: Xiao Lin, Splunk
+- **ID**: cca028f4-77dd-11ec-bc09-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1213](https://attack.mitre.org/techniques/T1213/) | Data from Information Repositories | Collection |
+
+| [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null) 
+| eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null)) 
+| where sourcetype == "pan:traffic" 
+| eval src_device_scope = map_get(input_event, "src_device_scope") 
+| eval dest_device_scope = map_get(input_event, "src_device_scope") 
+| where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL 
+| eval dest_device = map_get(input_event, "dest_device_ips") 
+| where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL" 
+| eval src_device = map_get(input_event, "source_device_ips") 
+| where src_device IS NOT NULL AND src_device_scope == "INTERNAL" 
+| eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string", null)) 
+| where download_bytes IS NOT NULL 
+| eval tenant = map_get(input_event, "_tenant"), event_id = map_get(input_event, "event_id") 
+| adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" threshold=0.001 window=86400L 
+| eval end_time = timestamp 
+| eval start_time = end_time - 86400 
+| eval body = create_map(["event_id", event_id, "tenant", tenant]) 
+| select start_time, end_time, dest_device, label, body 
+| into write_ssa_detected_events();
+```
+
+#### Macros
+The SPL above uses the following Macros:
+
+Note that `unusual_volume_of_data_download_from_internal_server_per_entity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest_device_scope
+* bytes_in
+* src_device_ips
+
+
+#### How To Implement
+Ingest PAN traffic logs
+
+#### Known False Positives
+Benign large volume data download might be flagged as (false) positive.
+
+#### Associated Analytic story
+* [Insider Threat](/stories/insider_threat)
+
+
+#### Kill Chain Phase
+* Weaponization
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | $src_device_ip downloaded unusually amount of data from internal server within one day |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://github.com/twitter/AnomalyDetection](https://github.com/twitter/AnomalyDetection)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt](https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/unusual_volume_of_data_download_from_internal_server_per_entity.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
similarity index 92%
rename from docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
rename to docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
index 156161fa1b..0bf192b760 100644
--- a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
@@ -3,7 +3,7 @@ title: "CertUtil Download With URLCache and Split Arguments"
 excerpt: "Ingress Tool Transfer"
 categories:
   - Endpoint
-last_modified_at: 2021-03-23
+last_modified_at: 2022-02-03
 toc: true
 toc_label: ""
 tags:
@@ -26,7 +26,7 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-23
+- **Last Updated**: 2022-02-03
 - **Author**: Michael Haag, Splunk
 - **ID**: 415b4306-8bfb-11eb-85c4-acde48001122
 
@@ -41,7 +41,7 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache* Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
@@ -114,4 +114,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
similarity index 93%
rename from docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
rename to docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
index fb296b4edf..b28f780ff3 100644
--- a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
@@ -3,7 +3,7 @@ title: "CertUtil Download With VerifyCtl and Split Arguments"
 excerpt: "Ingress Tool Transfer"
 categories:
   - Endpoint
-last_modified_at: 2021-03-23
+last_modified_at: 2022-02-03
 toc: true
 toc_label: ""
 tags:
@@ -26,7 +26,7 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-03-23
+- **Last Updated**: 2022-02-03
 - **Author**: Michael Haag, Splunk
 - **ID**: 801ad9e4-8bfb-11eb-8b31-acde48001122
 
@@ -41,7 +41,7 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl* Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user Processes.original_file_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
@@ -115,4 +115,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
new file mode 100644
index 0000000000..c822b0c567
--- /dev/null
+++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
@@ -0,0 +1,115 @@
+---
+title: "Windows Remote Assistance Spawning Process"
+excerpt: "Process Injection"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-07
+toc: true
+toc_label: ""
+tags:
+  - Process Injection
+  - Defense Evasion
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network connection to the remote system that is connected. This behavior is indicative of another process injected into msra.exe. Review the parent process or cross process events to identify source.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-07
+- **Author**: Michael Haag, Splunk
+- **ID**: ced50492-8849-11ec-9f68-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_remote_assistance_spawning_process_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
+
+Note that `windows_remote_assistance_spawning_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives should be limited, filter as needed. Add additional shells as needed.
+
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
new file mode 100644
index 0000000000..9cbc4303c2
--- /dev/null
+++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
@@ -0,0 +1,124 @@
+---
+title: "Windows Schtasks Create Run As System"
+excerpt: "Scheduled Task, Scheduled Task/Job"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-07
+toc: true
+toc_label: ""
+tags:
+  - Scheduled Task
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Scheduled Task/Job
+  - Execution
+  - Persistence
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-07
+- **Author**: Michael Haag, Splunk
+- **ID**: 41a0e58e-884c-11ec-9976-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |
+
+| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_schtasks` Processes.process="*/create *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_schtasks_create_run_as_system_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+Note that `windows_schtasks_create_run_as_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
+
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 48.0 | 80 | 60 | An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/](https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/)
+* [https://www.ired.team/offensive-security/persistence/t1053-schtask](https://www.ired.team/offensive-security/persistence/t1053-schtask)
+* [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
new file mode 100644
index 0000000000..4bbca30820
--- /dev/null
+++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
@@ -0,0 +1,120 @@
+---
+title: "RunDLL Loading DLL By Ordinal"
+excerpt: "Signed Binary Proxy Execution, Rundll32"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-08
+toc: true
+toc_label: ""
+tags:
+  - Signed Binary Proxy Execution
+  - Defense Evasion
+  - Rundll32
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Utilizing ordinal values makes it a bit more complicated for analysts to understand the behavior until the DLL is reviewed.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-08
+- **Author**: Michael Haag, David Dorsey, Splunk
+- **ID**: 6c135f8d-5e60-454e-80b7-c56eed739833
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| where match(process,"rundll32.+\#\d+") 
+| `rundll_loading_dll_by_ordinal_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+Note that `rundll_loading_dll_by_ordinal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
+
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+
+
+#### Kill Chain Phase
+* Installation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml) \| *version*: **6**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-11-windows_powershell_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-02-11-windows_powershell_connect_to_internet_with_hidden_window.md
new file mode 100644
index 0000000000..8c77f3b277
--- /dev/null
+++ b/docs/_posts/2022-02-11-windows_powershell_connect_to_internet_with_hidden_window.md
@@ -0,0 +1,118 @@
+---
+title: "Windows Powershell Connect to Internet With Hidden Window"
+excerpt: "Automated Exfiltration"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-11
+toc: true
+toc_label: ""
+tags:
+  - Automated Exfiltration
+  - Exfiltration
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2022-02-11
+- **Author**: Jose Hernandez, David Dorsey, Michael Haag Splunk
+- **ID**: 477e068e-8b6d-11ec-b6c1-81af21670352
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
+| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe" 
+| where match_regex(cmd_line, /(?i)[\\-
+|\\/
+|\u2013\
+|\u2014
+|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Macros
+The SPL above uses the following Macros:
+
+Note that `windows_powershell_connect_to_internet_with_hidden_window_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### How To Implement
+You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the &#34;process&#34; field in the Endpoint data model.
+
+#### Known False Positives
+Legitimate process can have this combination of command-line options, but it&#39;s not common.
+
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns)
+* [HAFNIUM Group](/stories/hafnium_group)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
+#### Kill Chain Phase
+* Exfiltration
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 35.0 | 50 | 70 | PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://regexr.com/663rr](https://regexr.com/663rr)
+* [https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1](https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1)
+* [https://ss64.com/ps/powershell.html](https://ss64.com/ps/powershell.html)
+* [https://twitter.com/M_haggis/status/1440758396534214658?s=20](https://twitter.com/M_haggis/status/1440758396534214658?s=20)
+* [https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/](https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_powershell_connect_to_internet_with_hidden_window.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-11-windows_powershell_downloadfile.md b/docs/_posts/2022-02-11-windows_powershell_downloadfile.md
new file mode 100644
index 0000000000..0a911cad32
--- /dev/null
+++ b/docs/_posts/2022-02-11-windows_powershell_downloadfile.md
@@ -0,0 +1,111 @@
+---
+title: "Windows Powershell DownloadFile"
+excerpt: "Automated Exfiltration"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-11
+toc: true
+toc_label: ""
+tags:
+  - Automated Exfiltration
+  - Exfiltration
+  - Splunk Behavioral Analytics
+  - Endpoint_Processes
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Behavioral Analytics
+- **Datamodel**: [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
+- **Last Updated**: 2022-02-11
+- **Author**: Jose Hernandez, Michael Haag, Splunk
+- **ID**: 46440222-81d5-44b1-a376-19dcd70d1b08
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration |
+
+#### Search
+
+```
+
+| from read_ssa_enriched_events() 
+| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+| where cmd_line IS NOT NULL AND process_name IS NOT NULL 
+| where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" OR process_name="powershell.exe" OR process_name="powershell_ise.exe" 
+| where (like (cmd_line, "%downloadfile%")) 
+| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
+| into write_ssa_detected_events();
+```
+
+#### Macros
+The SPL above uses the following Macros:
+
+Note that `windows_powershell_downloadfile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest_device_id
+* process_name
+* parent_process_name
+* process_path
+* dest_user_id
+* process
+* cmd_line
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
+
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
+#### Kill Chain Phase
+* Lateral Movement
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0)
+* [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_powershell_downloadfile.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
new file mode 100644
index 0000000000..689c9f9ca5
--- /dev/null
+++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
@@ -0,0 +1,126 @@
+---
+title: "Windows Rasautou DLL Execution"
+excerpt: "Dynamic-link Library Injection, Signed Binary Proxy Execution, Process Injection"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-15
+toc: true
+toc_label: ""
+tags:
+  - Dynamic-link Library Injection
+  - Defense Evasion
+  - Privilege Escalation
+  - Signed Binary Proxy Execution
+  - Defense Evasion
+  - Process Injection
+  - Defense Evasion
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-15
+- **Author**: Michael Haag, Splunk
+- **ID**: 6f42b8be-8e96-11ec-ad5a-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1055.001](https://attack.mitre.org/techniques/T1055/001/) | Dynamic-link Library Injection | Defense Evasion, Privilege Escalation |
+
+| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion |
+
+| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_rasautou_dll_execution_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+Note that `windows_rasautou_dll_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
+
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner. |
+
+
+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
+
+
+#### Reference
+
+* [https://github.com/mandiant/DueDLLigence](https://github.com/mandiant/DueDLLigence)
+* [https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1](https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1)
+* [https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513](https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513)
+* [https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html](https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_rasautou_dll_execution.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md
index a3f454b5e4..99b0828fa0 100644
--- a/docs/_stories/credential_dumping.md
+++ b/docs/_stories/credential_dumping.md
@@ -35,8 +35,8 @@ The detection searches in this Analytic Story monitor access to the Local Securi
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
 | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
diff --git a/docs/_stories/hafnium_group.md b/docs/_stories/hafnium_group.md
index 270972af69..1e6493d72b 100644
--- a/docs/_stories/hafnium_group.md
+++ b/docs/_stories/hafnium_group.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Traffic
 ---
 
@@ -18,7 +19,7 @@ tags:
 HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
 - **Last Updated**: 2021-03-03
 - **Author**: Michael Haag, Splunk
 - **ID**: beae2ab0-7c3f-11eb-8b63-acde48001122
@@ -48,6 +49,7 @@ The following Splunk detections assist with identifying the HAFNIUM groups trade
 | [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [Unified Messaging Service Spawning a Process](/endpoint/unified_messaging_service_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
 | [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/ingress_tool_transfer.md b/docs/_stories/ingress_tool_transfer.md
index 078b9ab0ae..37cf9a276d 100644
--- a/docs/_stories/ingress_tool_transfer.md
+++ b/docs/_stories/ingress_tool_transfer.md
@@ -42,6 +42,7 @@ Ingress tool transfer is a Technique under tactic Command and Control. Behaviors
 | [Windows Curl Download to Suspicious Path](/endpoint/windows_curl_download_to_suspicious_path/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
+| [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/log4shell_cve-2021-44228.md b/docs/_stories/log4shell_cve-2021-44228.md
index 37c3708b5e..35970c7731 100644
--- a/docs/_stories/log4shell_cve-2021-44228.md
+++ b/docs/_stories/log4shell_cve-2021-44228.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
   - Network_Traffic
   - Web
 ---
@@ -19,7 +20,7 @@ tags:
 Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic), [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses), [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic), [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
 - **Last Updated**: 2021-12-11
 - **Author**: Jose Hernandez
 - **ID**: b4453928-5a98-11ec-afcd-8de10b48fc52
@@ -45,6 +46,8 @@ In late November 2021, Chen Zhaojun of Alibaba identified a remote code executio
 | [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Hunting |
 | [Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows Java Spawning Shells](/endpoint/windows_java_spawning_shells/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
+| [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md
index eacb96c613..45f7ce457d 100644
--- a/docs/_stories/malicious_powershell.md
+++ b/docs/_stories/malicious_powershell.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -17,7 +18,7 @@ tags:
 Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
 - **Last Updated**: 2017-08-23
 - **Author**: David Dorsey, Splunk
 - **ID**: 2c8ff66e-0b57-42af-8ad7-912438a403fc
@@ -64,6 +65,8 @@ Most recently we have added new content related to PowerShell Script Block loggi
 | [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
+| [Windows Powershell DownloadFile](/endpoint/windows_powershell_downloadfile/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md b/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md
index b79362f204..b8ad6c1ccd 100644
--- a/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md
+++ b/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md
@@ -8,6 +8,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Endpoint_Processes
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -17,7 +18,7 @@ tags:
 Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Endpoint_Processes](https://docs.splunk.com/Documentation/CIM/latest/User/EndpointProcesses)
 - **Last Updated**: 2020-01-22
 - **Author**: iDefense Cyber Espionage Team, iDefense
 - **ID**: 988C59C5-0A1C-45B6-A555-0C62276E327E
@@ -61,6 +62,7 @@ If behavioral searches included in this story yield positive hits, iDefense reco
 | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) |  | Anomaly |
 | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) |  | Anomaly |
+| [Windows Powershell Connect to Internet With Hidden Window](/endpoint/windows_powershell_connect_to_internet_with_hidden_window/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Anomaly |
 
 #### Reference
 
diff --git a/docs/_stories/suspicious_rundll32_activity.md b/docs/_stories/suspicious_rundll32_activity.md
index fd9bebf848..4e756c283c 100644
--- a/docs/_stories/suspicious_rundll32_activity.md
+++ b/docs/_stories/suspicious_rundll32_activity.md
@@ -34,6 +34,7 @@ One common adversary tactic is to bypass application control solutions via the r
 | [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
+| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | Hunting |
 | [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
diff --git a/docs/_stories/unusual_processes.md b/docs/_stories/unusual_processes.md
index 4dd5c0cb17..0628ca5535 100644
--- a/docs/_stories/unusual_processes.md
+++ b/docs/_stories/unusual_processes.md
@@ -38,6 +38,7 @@ In the event an unusual process is identified, it is imperative to better unders
 | [Detect processes used for System Network Configuration Discovery](/endpoint/detect_processes_used_for_system_network_configuration_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | TTP |
 | [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly |
 | [Rare Parent-Child Process Relationship](/endpoint/rare_parent-child_process_relationship/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job), [Software Deployment Tools](/tags/#software-deployment-tools) | Anomaly |
+| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry) | TTP |
 | [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading) | TTP |
 | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP |
@@ -49,6 +50,7 @@ In the event an unusual process is identified, it is imperative to better unders
 | [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | TTP |
 | [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | TTP |
 | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool) | TTP |
+| [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection) | TTP |
 | [Wscript Or Cscript Suspicious Child Process](/endpoint/wscript_or_cscript_suspicious_child_process/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | TTP |
 
 #### Reference
diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md
index 001a481dac..077d5a4ef8 100644
--- a/docs/_stories/windows_defense_evasion_tactics.md
+++ b/docs/_stories/windows_defense_evasion_tactics.md
@@ -51,8 +51,8 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [Firewall Allowed Program Enable](/endpoint/firewall_allowed_program_enable/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Powershell Windows Defender Exclusion Commands](/endpoint/powershell_windows_defender_exclusion_commands/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
@@ -66,6 +66,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [Windows DISM Remove Defender](/endpoint/windows_dism_remove_defender/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | TTP |
 
 #### Reference
 
diff --git a/docs/_stories/windows_persistence_techniques.md b/docs/_stories/windows_persistence_techniques.md
index 6643cec58e..2a309c5ec7 100644
--- a/docs/_stories/windows_persistence_techniques.md
+++ b/docs/_stories/windows_persistence_techniques.md
@@ -36,8 +36,8 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
 | [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
 | [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP |
 | [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
@@ -56,6 +56,7 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | Hunting |
+| [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 
 #### Reference
 
diff --git a/docs/index.markdown b/docs/index.markdown
index db6b78b036..e1bb85bc5a 100644
--- a/docs/index.markdown
+++ b/docs/index.markdown
@@ -9,12 +9,12 @@ header:
   actions:
     - label: "Download"
       url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **749** detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **756** detections for Splunk."
 feature_row:
   - image_path: /static/feature_detection.png
     alt: "customizable"
     title: "Detections"
-    excerpt: "See all **749** Splunk Analytics built to find evil 😈."
+    excerpt: "See all **756** Splunk Analytics built to find evil 😈."
     url: "/detections"
     btn_class: "btn--primary"
     btn_label: "Explore"
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index 64281d6e19..04c865189d 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -86,44 +86,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -156,31 +155,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -216,9 +216,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -275,27 +277,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -519,8 +523,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -585,18 +589,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -1463,57 +1468,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -1530,52 +1536,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -1650,7 +1655,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -1906,44 +1912,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -1976,31 +1981,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -2036,9 +2042,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -2095,27 +2103,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -2339,8 +2349,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -2405,18 +2415,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -3283,57 +3294,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -3350,52 +3362,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -3470,7 +3481,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -3726,44 +3738,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -3796,31 +3807,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -3856,9 +3868,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -3915,27 +3929,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -4159,8 +4175,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -4225,18 +4241,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -5103,57 +5120,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -5170,52 +5188,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -5290,7 +5307,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -5546,44 +5564,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -5616,31 +5633,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -5676,9 +5694,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -5735,27 +5755,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -5979,8 +6001,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -6045,18 +6067,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -6923,57 +6946,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -6990,52 +7014,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -7110,7 +7133,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -7366,44 +7390,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -7436,31 +7459,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -7496,9 +7520,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -7555,27 +7581,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -7799,8 +7827,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -7865,18 +7893,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -8743,57 +8772,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -8810,52 +8840,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -8930,7 +8959,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -9186,44 +9216,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -9256,31 +9285,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -9316,9 +9346,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -9375,27 +9407,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -9619,8 +9653,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -9685,18 +9719,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -10563,57 +10598,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -10630,52 +10666,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -10750,7 +10785,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -11006,44 +11042,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -11076,31 +11111,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -11136,9 +11172,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -11195,27 +11233,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -11439,8 +11479,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -11505,18 +11545,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -12383,57 +12424,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -12450,52 +12492,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -12570,7 +12611,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -12826,44 +12868,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -12896,31 +12937,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -12956,9 +12998,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -13015,27 +13059,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -13259,8 +13305,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -13325,18 +13371,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -14203,57 +14250,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -14270,52 +14318,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -14390,7 +14437,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -14646,44 +14694,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -14716,31 +14763,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -14776,9 +14824,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -14835,27 +14885,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -15079,8 +15131,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -15145,18 +15197,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -16023,57 +16076,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -16090,52 +16144,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -16210,7 +16263,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -16466,44 +16520,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -16536,31 +16589,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -16596,9 +16650,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -16655,27 +16711,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -16899,8 +16957,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -16965,18 +17023,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -17843,57 +17902,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -17910,52 +17970,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -18030,7 +18089,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -18286,44 +18346,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -18356,31 +18415,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -18416,9 +18476,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -18475,27 +18537,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -18719,8 +18783,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -18785,18 +18849,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -19663,57 +19728,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -19730,52 +19796,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -19850,7 +19915,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -20106,44 +20172,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -20176,31 +20241,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -20236,9 +20302,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -20295,27 +20363,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -20539,8 +20609,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -20605,18 +20675,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -21483,57 +21554,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -21550,52 +21622,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -21670,7 +21741,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -21926,44 +21998,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -21996,31 +22067,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -22056,9 +22128,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -22115,27 +22189,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -22359,8 +22435,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -22425,18 +22501,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -23303,57 +23380,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -23370,52 +23448,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -23490,7 +23567,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -23746,44 +23824,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -23816,31 +23893,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -23876,9 +23954,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -23935,27 +24015,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -24179,8 +24261,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -24245,18 +24327,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -25123,57 +25206,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -25190,52 +25274,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -25310,7 +25393,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -25566,44 +25650,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -25636,31 +25719,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -25696,9 +25780,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -25755,27 +25841,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -25999,8 +26087,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -26065,18 +26153,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -26943,57 +27032,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -27010,52 +27100,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -27130,7 +27219,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -27386,44 +27476,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -27456,31 +27545,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -27516,9 +27606,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -27575,27 +27667,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -27819,8 +27913,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -27885,18 +27979,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -28763,57 +28858,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -28830,52 +28926,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -28950,7 +29045,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -29206,44 +29302,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -29276,31 +29371,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -29336,9 +29432,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -29395,27 +29493,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -29639,8 +29739,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -29705,18 +29805,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -30583,57 +30684,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -30650,52 +30752,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -30770,7 +30871,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -31026,44 +31128,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -31096,31 +31197,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -31156,9 +31258,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -31215,27 +31319,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -31459,8 +31565,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -31525,18 +31631,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -32403,57 +32510,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -32470,52 +32578,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -32590,7 +32697,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -32846,44 +32954,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -32916,31 +33023,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -32976,9 +33084,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -33035,27 +33145,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -33279,8 +33391,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -33345,18 +33457,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -34223,57 +34336,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -34290,52 +34404,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -34410,7 +34523,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -34666,44 +34780,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -34736,31 +34849,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -34796,9 +34910,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -34855,27 +34971,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -35099,8 +35217,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -35165,18 +35283,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -36043,57 +36162,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -36110,52 +36230,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -36230,7 +36349,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -36486,44 +36606,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -36556,31 +36675,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -36616,9 +36736,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -36675,27 +36797,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -36919,8 +37043,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -36985,18 +37109,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -37863,57 +37988,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -37930,52 +38056,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -38050,7 +38175,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -38306,44 +38432,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -38376,31 +38501,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -38436,9 +38562,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -38495,27 +38623,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -38739,8 +38869,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -38805,18 +38935,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -39683,57 +39814,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -39750,52 +39882,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -39870,7 +40001,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -40126,44 +40258,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -40196,31 +40327,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -40256,9 +40388,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -40315,27 +40449,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -40559,8 +40695,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -40625,18 +40761,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -41503,57 +41640,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -41570,52 +41708,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -41690,7 +41827,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -41946,44 +42084,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -42016,31 +42153,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -42076,9 +42214,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -42135,27 +42275,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -42379,8 +42521,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -42445,18 +42587,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -43323,57 +43466,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -43390,52 +43534,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -43510,7 +43653,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -43766,44 +43910,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -43836,31 +43979,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -43896,9 +44040,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -43955,27 +44101,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -44199,8 +44347,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -44265,18 +44413,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -45143,57 +45292,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -45210,52 +45360,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -45330,7 +45479,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -45586,44 +45736,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -45656,31 +45805,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -45716,9 +45866,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -45775,27 +45927,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -46019,8 +46173,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -46085,18 +46239,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -46963,57 +47118,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -47030,52 +47186,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -47150,7 +47305,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -47406,44 +47562,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -47476,31 +47631,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -47536,9 +47692,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -47595,27 +47753,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -47839,8 +47999,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -47905,18 +48065,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -48783,57 +48944,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -48850,52 +49012,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -48970,7 +49131,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -49226,44 +49388,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -49296,31 +49457,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -49356,9 +49518,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -49415,27 +49579,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -49659,8 +49825,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -49725,18 +49891,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -50603,57 +50770,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -50670,52 +50838,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -50790,7 +50957,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -51046,44 +51214,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -51116,31 +51283,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -51176,9 +51344,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -51235,27 +51405,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -51479,8 +51651,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -51545,18 +51717,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -52423,57 +52596,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -52490,52 +52664,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -52610,7 +52783,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -52866,44 +53040,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -52936,31 +53109,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -52996,9 +53170,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -53055,27 +53231,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -53299,8 +53477,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -53365,18 +53543,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -54243,57 +54422,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -54310,52 +54490,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -54430,7 +54609,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -54686,44 +54866,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -54756,31 +54935,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -54816,9 +54996,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -54875,27 +55057,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -55119,8 +55303,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -55185,18 +55369,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -56063,57 +56248,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -56130,52 +56316,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -56250,7 +56435,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -56506,44 +56692,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -56576,31 +56761,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -56636,9 +56822,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -56695,27 +56883,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -56939,8 +57129,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -57005,18 +57195,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -57883,57 +58074,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -57950,52 +58142,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -58070,7 +58261,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -58326,44 +58518,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -58396,31 +58587,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -58456,9 +58648,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -58515,27 +58709,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -58759,8 +58955,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -58825,18 +59021,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -59703,57 +59900,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -59770,52 +59968,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -59890,7 +60087,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -60146,44 +60344,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -60216,31 +60413,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -60276,9 +60474,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -60335,27 +60535,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -60579,8 +60781,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -60645,18 +60847,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -61523,57 +61726,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -61590,52 +61794,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -61710,7 +61913,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -61966,44 +62170,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -62036,31 +62239,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -62096,9 +62300,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -62155,27 +62361,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -62399,8 +62607,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -62465,18 +62673,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -63343,57 +63552,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -63410,52 +63620,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -63530,7 +63739,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -63786,44 +63996,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -63856,31 +64065,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -63916,9 +64126,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -63975,27 +64187,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -64219,8 +64433,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -64285,18 +64499,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -65163,57 +65378,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -65230,52 +65446,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -65350,7 +65565,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -65606,44 +65822,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -65676,31 +65891,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -65736,9 +65952,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -65795,27 +66013,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -66039,8 +66259,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -66105,18 +66325,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -66983,57 +67204,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -67050,52 +67272,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -67170,7 +67391,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -67426,44 +67648,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -67496,31 +67717,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -67556,9 +67778,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -67615,27 +67839,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -67859,8 +68085,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -67925,18 +68151,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -68803,57 +69030,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -68870,52 +69098,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -68990,7 +69217,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -69246,44 +69474,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -69316,31 +69543,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -69376,9 +69604,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -69435,27 +69665,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -69679,8 +69911,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -69745,18 +69977,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -70623,57 +70856,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -70690,52 +70924,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -70810,7 +71043,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -71066,44 +71300,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -71136,31 +71369,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -71196,9 +71430,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -71255,27 +71491,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -71499,8 +71737,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -71565,18 +71803,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -72443,57 +72682,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -72510,52 +72750,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -72630,7 +72869,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -72886,44 +73126,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -72956,31 +73195,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -73016,9 +73256,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -73075,27 +73317,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -73319,8 +73563,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -73385,18 +73629,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -74263,57 +74508,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -74330,52 +74576,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -74450,7 +74695,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -74706,44 +74952,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -74776,31 +75021,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -74836,9 +75082,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -74895,27 +75143,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -75139,8 +75389,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -75205,18 +75455,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -76083,57 +76334,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -76150,52 +76402,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -76270,7 +76521,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -76526,44 +76778,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -76596,31 +76847,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -76656,9 +76908,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -76715,27 +76969,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -76959,8 +77215,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -77025,18 +77281,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -77903,57 +78160,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -77970,52 +78228,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -78090,7 +78347,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -78346,44 +78604,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -78416,31 +78673,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -78476,9 +78734,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -78535,27 +78795,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -78779,8 +79041,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -78845,18 +79107,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -79723,57 +79986,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -79790,52 +80054,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -79910,7 +80173,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -80166,44 +80430,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -80236,31 +80499,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -80296,9 +80560,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -80355,27 +80621,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -80599,8 +80867,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -80665,18 +80933,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -81543,57 +81812,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -81610,52 +81880,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -81730,7 +81999,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -81986,44 +82256,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -82056,31 +82325,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -82116,9 +82386,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -82175,27 +82447,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -82419,8 +82693,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -82485,18 +82759,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -83363,57 +83638,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -83430,52 +83706,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -83550,7 +83825,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -83806,44 +84082,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -83876,31 +84151,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -83936,9 +84212,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -83995,27 +84273,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -84239,8 +84519,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -84305,18 +84585,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -85183,57 +85464,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -85250,52 +85532,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -85370,7 +85651,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -85626,44 +85908,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -85696,31 +85977,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -85756,9 +86038,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -85815,27 +86099,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -86059,8 +86345,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -86125,18 +86411,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -87003,57 +87290,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -87070,52 +87358,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -87190,7 +87477,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -87446,44 +87734,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -87516,31 +87803,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -87576,9 +87864,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -87635,27 +87925,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -87879,8 +88171,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -87945,18 +88237,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -88823,57 +89116,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -88890,52 +89184,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -89010,7 +89303,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -89266,44 +89560,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -89336,31 +89629,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -89396,9 +89690,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -89455,27 +89751,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -89699,8 +89997,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -89765,18 +90063,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -90643,57 +90942,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -90710,52 +91010,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -90830,7 +91129,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -91086,44 +91386,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -91156,31 +91455,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -91216,9 +91516,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -91275,27 +91577,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -91519,8 +91823,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -91585,18 +91889,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -92463,57 +92768,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -92530,52 +92836,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -92650,7 +92955,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -92906,44 +93212,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -92976,31 +93281,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -93036,9 +93342,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -93095,27 +93403,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -93339,8 +93649,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -93405,18 +93715,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -94283,57 +94594,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -94350,52 +94662,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -94470,7 +94781,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -94726,44 +95038,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -94796,31 +95107,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -94856,9 +95168,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -94915,27 +95229,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -95159,8 +95475,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -95225,18 +95541,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -96103,57 +96420,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -96170,52 +96488,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -96290,7 +96607,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -96546,44 +96864,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -96616,31 +96933,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -96676,9 +96994,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -96735,27 +97055,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -96979,8 +97301,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -97045,18 +97367,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -97923,57 +98246,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -97990,52 +98314,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -98110,7 +98433,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -98366,44 +98690,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -98436,31 +98759,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -98496,9 +98820,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -98555,27 +98881,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -98799,8 +99127,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -98865,18 +99193,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -99743,57 +100072,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -99810,52 +100140,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -99930,7 +100259,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -100186,44 +100516,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -100256,31 +100585,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -100316,9 +100646,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -100375,27 +100707,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -100619,8 +100953,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -100685,18 +101019,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -101563,57 +101898,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -101630,52 +101966,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -101750,7 +102085,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -102006,44 +102342,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -102076,31 +102411,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -102136,9 +102472,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -102195,27 +102533,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -102439,8 +102779,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -102505,18 +102845,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -103383,57 +103724,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -103450,52 +103792,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -103570,7 +103911,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -103826,44 +104168,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -103896,31 +104237,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -103956,9 +104298,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -104015,27 +104359,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -104259,8 +104605,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -104325,18 +104671,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -105203,57 +105550,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -105270,52 +105618,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -105390,7 +105737,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -105646,44 +105994,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -105716,31 +106063,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -105776,9 +106124,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -105835,27 +106185,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -106079,8 +106431,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -106145,18 +106497,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -107023,57 +107376,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -107090,52 +107444,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -107210,7 +107563,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -107466,44 +107820,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -107536,31 +107889,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -107596,9 +107950,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -107655,27 +108011,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -107899,8 +108257,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -107965,18 +108323,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -108843,57 +109202,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -108910,52 +109270,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -109030,7 +109389,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -109286,44 +109646,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -109356,31 +109715,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -109416,9 +109776,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -109475,27 +109837,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -109719,8 +110083,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -109785,18 +110149,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -110663,57 +111028,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -110730,52 +111096,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -110850,7 +111215,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -111106,44 +111472,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -111176,31 +111541,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -111236,9 +111602,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -111295,27 +111663,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -111539,8 +111909,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -111605,18 +111975,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -112483,57 +112854,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -112550,52 +112922,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -112670,7 +113041,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -112926,44 +113298,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -112996,31 +113367,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -113056,9 +113428,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -113115,27 +113489,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -113359,8 +113735,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -113425,18 +113801,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -114303,57 +114680,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -114370,52 +114748,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -114490,7 +114867,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -114746,44 +115124,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -114816,31 +115193,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -114876,9 +115254,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -114935,27 +115315,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -115179,8 +115561,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -115245,18 +115627,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -116123,57 +116506,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -116190,52 +116574,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -116310,7 +116693,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -116566,44 +116950,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -116636,31 +117019,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -116696,9 +117080,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -116755,27 +117141,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -116999,8 +117387,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -117065,18 +117453,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -117943,57 +118332,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -118010,52 +118400,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -118130,7 +118519,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -118386,44 +118776,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -118456,31 +118845,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -118516,9 +118906,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -118575,27 +118967,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -118819,8 +119213,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -118885,18 +119279,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -119763,57 +120158,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -119830,52 +120226,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -119950,7 +120345,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -120206,44 +120602,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -120276,31 +120671,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -120336,9 +120732,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -120395,27 +120793,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -120639,8 +121039,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -120705,18 +121105,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -121583,57 +121984,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -121650,52 +122052,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -121770,7 +122171,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -122026,44 +122428,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -122096,31 +122497,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -122156,9 +122558,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -122215,27 +122619,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -122459,8 +122865,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -122525,18 +122931,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -123403,57 +123810,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -123470,52 +123878,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -123590,7 +123997,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -123846,44 +124254,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -123916,31 +124323,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -123976,9 +124384,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -124035,27 +124445,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -124279,8 +124691,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -124345,18 +124757,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -125223,57 +125636,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -125290,52 +125704,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -125410,7 +125823,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -125666,44 +126080,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -125736,31 +126149,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -125796,9 +126210,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -125855,27 +126271,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -126099,8 +126517,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -126165,18 +126583,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -127043,57 +127462,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -127110,52 +127530,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -127230,7 +127649,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -127486,44 +127906,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -127556,31 +127975,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -127616,9 +128036,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -127675,27 +128097,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -127919,8 +128343,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -127985,18 +128409,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -128863,57 +129288,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -128930,52 +129356,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -129050,7 +129475,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -129306,44 +129732,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -129376,31 +129801,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -129436,9 +129862,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -129495,27 +129923,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -129739,8 +130169,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -129805,18 +130235,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -130683,57 +131114,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -130750,52 +131182,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -130870,7 +131301,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -131126,44 +131558,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -131196,31 +131627,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -131256,9 +131688,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -131315,27 +131749,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -131559,8 +131995,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -131625,18 +132061,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -132503,57 +132940,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -132570,52 +133008,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -132690,7 +133127,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -132946,44 +133384,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -133016,31 +133453,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -133076,9 +133514,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -133135,27 +133575,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -133379,8 +133821,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -133445,18 +133887,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -134323,57 +134766,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -134390,52 +134834,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -134510,7 +134953,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -134766,44 +135210,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -134836,31 +135279,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -134896,9 +135340,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -134955,27 +135401,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -135199,8 +135647,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -135265,18 +135713,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -136143,57 +136592,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -136210,52 +136660,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -136330,7 +136779,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -136586,44 +137036,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -136656,31 +137105,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -136716,9 +137166,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -136775,27 +137227,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -137019,8 +137473,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -137085,18 +137539,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -137963,57 +138418,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -138030,52 +138486,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -138150,7 +138605,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -138406,44 +138862,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -138476,31 +138931,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -138536,9 +138992,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -138595,27 +139053,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -138839,8 +139299,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -138905,18 +139365,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -139783,57 +140244,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -139850,52 +140312,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -139970,7 +140431,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -140226,44 +140688,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -140296,31 +140757,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -140356,9 +140818,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -140415,27 +140879,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -140659,8 +141125,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -140725,18 +141191,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -141603,57 +142070,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -141670,52 +142138,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -141790,7 +142257,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -142046,44 +142514,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -142116,31 +142583,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -142176,9 +142644,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -142235,27 +142705,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -142479,8 +142951,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -142545,18 +143017,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -143423,57 +143896,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -143490,52 +143964,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -143610,7 +144083,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -143866,44 +144340,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -143936,31 +144409,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -143996,9 +144470,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -144055,27 +144531,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -144299,8 +144777,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -144365,18 +144843,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -145243,57 +145722,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -145310,52 +145790,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -145430,7 +145909,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -145686,44 +146166,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -145756,31 +146235,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -145816,9 +146296,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -145875,27 +146357,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -146119,8 +146603,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -146185,18 +146669,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -147063,57 +147548,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -147130,52 +147616,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -147250,7 +147735,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -147506,44 +147992,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -147576,31 +148061,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -147636,9 +148122,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -147695,27 +148183,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -147939,8 +148429,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -148005,18 +148495,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -148883,57 +149374,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -148950,52 +149442,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -149070,7 +149561,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -149326,44 +149818,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -149396,31 +149887,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -149456,9 +149948,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -149515,27 +150009,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -149759,8 +150255,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -149825,18 +150321,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -150703,57 +151200,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -150770,52 +151268,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -150890,7 +151387,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -151146,44 +151644,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -151216,31 +151713,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -151276,9 +151774,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -151335,27 +151835,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -151579,8 +152081,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -151645,18 +152147,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -152523,57 +153026,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -152590,52 +153094,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -152710,7 +153213,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -152966,44 +153470,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -153036,31 +153539,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -153096,9 +153600,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -153155,27 +153661,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -153399,8 +153907,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -153465,18 +153973,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -154343,57 +154852,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -154410,52 +154920,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -154530,7 +155039,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -154786,44 +155296,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -154856,31 +155365,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -154916,9 +155426,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -154975,27 +155487,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -155219,8 +155733,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -155285,18 +155799,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -156163,57 +156678,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -156230,52 +156746,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -156350,7 +156865,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -156606,44 +157122,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -156676,31 +157191,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -156736,9 +157252,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -156795,27 +157313,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -157039,8 +157559,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -157105,18 +157625,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -157983,57 +158504,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -158050,52 +158572,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -158170,7 +158691,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -158426,44 +158948,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -158496,31 +159017,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -158556,9 +159078,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -158615,27 +159139,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -158859,8 +159385,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -158925,18 +159451,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -159803,57 +160330,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -159870,52 +160398,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -159990,7 +160517,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -160246,44 +160774,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -160316,31 +160843,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -160376,9 +160904,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -160435,27 +160965,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -160679,8 +161211,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -160745,18 +161277,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -161623,57 +162156,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -161690,52 +162224,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -161810,7 +162343,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -162066,44 +162600,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -162136,31 +162669,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -162196,9 +162730,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -162255,27 +162791,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -162499,8 +163037,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -162565,18 +163103,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -163443,57 +163982,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -163510,52 +164050,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -163630,7 +164169,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -163886,44 +164426,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -163956,31 +164495,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -164016,9 +164556,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -164075,27 +164617,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -164319,8 +164863,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -164385,18 +164929,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -165263,57 +165808,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -165330,52 +165876,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -165450,7 +165995,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -165706,44 +166252,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -165776,31 +166321,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -165836,9 +166382,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -165895,27 +166443,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -166139,8 +166689,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -166205,18 +166755,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -167083,57 +167634,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -167150,52 +167702,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -167270,7 +167821,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -167526,44 +168078,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -167596,31 +168147,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -167656,9 +168208,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -167715,27 +168269,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -167959,8 +168515,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -168025,18 +168581,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -168903,57 +169460,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -168970,52 +169528,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -169090,7 +169647,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -169346,44 +169904,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -169416,31 +169973,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -169476,9 +170034,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -169535,27 +170095,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -169779,8 +170341,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -169845,18 +170407,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -170723,57 +171286,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -170790,52 +171354,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -170910,7 +171473,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -171166,44 +171730,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -171236,31 +171799,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -171296,9 +171860,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -171355,27 +171921,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -171599,8 +172167,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -171665,18 +172233,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -172543,57 +173112,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -172610,52 +173180,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -172730,7 +173299,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -172986,44 +173556,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -173056,31 +173625,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -173116,9 +173686,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -173175,27 +173747,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -173419,8 +173993,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -173485,18 +174059,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -174363,57 +174938,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -174430,52 +175006,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -174550,7 +175125,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -174806,44 +175382,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -174876,31 +175451,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -174936,9 +175512,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -174995,27 +175573,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -175239,8 +175819,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -175305,18 +175885,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -176183,57 +176764,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -176250,52 +176832,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -176370,7 +176951,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -176626,44 +177208,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -176696,31 +177277,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -176756,9 +177338,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -176815,27 +177399,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -177059,8 +177645,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -177125,18 +177711,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -178003,57 +178590,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -178070,52 +178658,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -178190,7 +178777,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -178446,44 +179034,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -178516,31 +179103,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -178576,9 +179164,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -178635,27 +179225,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -178879,8 +179471,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -178945,18 +179537,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -179823,57 +180416,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -179890,52 +180484,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -180010,7 +180603,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -180266,44 +180860,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -180336,31 +180929,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -180396,9 +180990,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -180455,27 +181051,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -180699,8 +181297,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -180765,18 +181363,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -181643,57 +182242,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -181710,52 +182310,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -181830,7 +182429,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -182086,44 +182686,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -182156,31 +182755,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -182216,9 +182816,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -182275,27 +182877,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -182519,8 +183123,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -182585,18 +183189,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -183463,57 +184068,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -183530,52 +184136,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -183650,7 +184255,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -183906,44 +184512,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -183976,31 +184581,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -184036,9 +184642,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -184095,27 +184703,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -184339,8 +184949,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -184405,18 +185015,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -185283,57 +185894,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -185350,52 +185962,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -185470,7 +186081,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -185726,44 +186338,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -185796,31 +186407,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -185856,9 +186468,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -185915,27 +186529,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -186159,8 +186775,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -186225,18 +186841,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -187103,57 +187720,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -187170,52 +187788,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -187290,7 +187907,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -187546,44 +188164,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -187616,31 +188233,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -187676,9 +188294,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -187735,27 +188355,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -187979,8 +188601,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -188045,18 +188667,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -188923,57 +189546,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -188990,52 +189614,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -189110,7 +189733,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -189366,44 +189990,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -189436,31 +190059,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -189496,9 +190120,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -189555,27 +190181,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -189799,8 +190427,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -189865,18 +190493,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -190743,57 +191372,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -190810,52 +191440,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -190930,7 +191559,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -191186,44 +191816,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -191256,31 +191885,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -191316,9 +191946,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -191375,27 +192007,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -191619,8 +192253,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -191685,18 +192319,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -192563,57 +193198,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -192630,52 +193266,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -192750,7 +193385,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -193006,44 +193642,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -193076,31 +193711,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -193136,9 +193772,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -193195,27 +193833,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -193439,8 +194079,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -193505,18 +194145,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -194383,57 +195024,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -194450,52 +195092,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -194570,7 +195211,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -194826,44 +195468,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -194896,31 +195537,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -194956,9 +195598,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -195015,27 +195659,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -195259,8 +195905,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -195325,18 +195971,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -196203,57 +196850,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -196270,52 +196918,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -196390,7 +197037,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -196646,44 +197294,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -196716,31 +197363,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -196776,9 +197424,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -196835,27 +197485,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -197079,8 +197731,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -197145,18 +197797,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -198023,57 +198676,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -198090,52 +198744,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -198210,7 +198863,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -198466,44 +199120,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -198536,31 +199189,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -198596,9 +199250,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -198655,27 +199311,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -198899,8 +199557,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -198965,18 +199623,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -199843,57 +200502,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -199910,52 +200570,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -200030,7 +200689,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -200286,44 +200946,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -200356,31 +201015,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -200416,9 +201076,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -200475,27 +201137,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -200719,8 +201383,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -200785,18 +201449,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -201663,57 +202328,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -201730,52 +202396,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -201850,7 +202515,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -202106,44 +202772,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -202176,31 +202841,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -202236,9 +202902,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -202295,27 +202963,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -202539,8 +203209,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -202605,18 +203275,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -203483,57 +204154,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -203550,52 +204222,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -203670,7 +204341,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -203926,44 +204598,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -203996,31 +204667,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -204056,9 +204728,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -204115,27 +204789,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -204359,8 +205035,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -204425,18 +205101,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -205303,57 +205980,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -205370,52 +206048,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -205490,7 +206167,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -205746,44 +206424,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -205816,31 +206493,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -205876,9 +206554,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -205935,27 +206615,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -206179,8 +206861,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -206245,18 +206927,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -207123,57 +207806,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -207190,52 +207874,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -207310,7 +207993,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -207566,44 +208250,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -207636,31 +208319,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -207696,9 +208380,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -207755,27 +208441,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -207999,8 +208687,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -208065,18 +208753,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -208943,57 +209632,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -209010,52 +209700,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -209130,7 +209819,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -209386,44 +210076,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -209456,31 +210145,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -209516,9 +210206,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -209575,27 +210267,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -209819,8 +210513,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -209885,18 +210579,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -210763,57 +211458,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -210830,52 +211526,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -210950,7 +211645,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -211206,44 +211902,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -211276,31 +211971,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -211336,9 +212032,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -211395,27 +212093,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -211639,8 +212339,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -211705,18 +212405,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -212583,57 +213284,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -212650,52 +213352,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -212770,7 +213471,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -213026,44 +213728,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -213096,31 +213797,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -213156,9 +213858,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -213215,27 +213919,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -213459,8 +214165,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -213525,18 +214231,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -214403,57 +215110,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -214470,52 +215178,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -214590,7 +215297,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -214846,44 +215554,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -214916,31 +215623,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -214976,9 +215684,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -215035,27 +215745,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -215279,8 +215991,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -215345,18 +216057,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -216223,57 +216936,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -216290,52 +217004,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -216410,7 +217123,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -216666,44 +217380,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -216736,31 +217449,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -216796,9 +217510,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -216855,27 +217571,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -217099,8 +217817,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -217165,18 +217883,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -218043,57 +218762,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -218110,52 +218830,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -218230,7 +218949,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -218486,44 +219206,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -218556,31 +219275,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -218616,9 +219336,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -218675,27 +219397,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -218919,8 +219643,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -218985,18 +219709,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -219863,57 +220588,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -219930,52 +220656,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -220050,7 +220775,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -220306,44 +221032,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -220376,31 +221101,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -220436,9 +221162,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -220495,27 +221223,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -220739,8 +221469,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -220805,18 +221535,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -221683,57 +222414,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -221750,52 +222482,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -221870,7 +222601,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -222126,44 +222858,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -222196,31 +222927,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -222256,9 +222988,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -222315,27 +223049,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -222559,8 +223295,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -222625,18 +223361,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -223503,57 +224240,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -223570,52 +224308,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -223690,7 +224427,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -223946,44 +224684,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -224016,31 +224753,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -224076,9 +224814,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -224135,27 +224875,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -224379,8 +225121,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -224445,18 +225187,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -225323,57 +226066,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -225390,52 +226134,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -225510,7 +226253,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -225766,44 +226510,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -225836,31 +226579,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -225896,9 +226640,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -225955,27 +226701,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -226199,8 +226947,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -226265,18 +227013,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -227143,57 +227892,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -227210,52 +227960,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -227330,7 +228079,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -227586,44 +228336,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -227656,31 +228405,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -227716,9 +228466,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -227775,27 +228527,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -228019,8 +228773,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -228085,18 +228839,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -228963,57 +229718,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -229030,52 +229786,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -229150,7 +229905,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -229406,44 +230162,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -229476,31 +230231,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -229536,9 +230292,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -229595,27 +230353,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -229839,8 +230599,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -229905,18 +230665,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -230783,57 +231544,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -230850,52 +231612,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -230970,7 +231731,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -231226,44 +231988,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -231296,31 +232057,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -231356,9 +232118,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -231415,27 +232179,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -231659,8 +232425,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -231725,18 +232491,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -232603,57 +233370,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -232670,52 +233438,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -232790,7 +233557,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -233046,44 +233814,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -233116,31 +233883,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -233176,9 +233944,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -233235,27 +234005,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -233479,8 +234251,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -233545,18 +234317,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -234423,57 +235196,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -234490,52 +235264,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -234610,7 +235383,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -234866,44 +235640,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -234936,31 +235709,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -234996,9 +235770,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -235055,27 +235831,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -235299,8 +236077,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -235365,18 +236143,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -236243,57 +237022,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -236310,52 +237090,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -236430,7 +237209,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -236686,44 +237466,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -236756,31 +237535,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -236816,9 +237596,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -236875,27 +237657,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -237119,8 +237903,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -237185,18 +237969,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -238063,57 +238848,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -238130,52 +238916,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -238250,7 +239035,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -238506,44 +239292,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -238576,31 +239361,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -238636,9 +239422,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -238695,27 +239483,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -238939,8 +239729,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -239005,18 +239795,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -239883,57 +240674,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -239950,52 +240742,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -240070,7 +240861,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -240326,44 +241118,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -240396,31 +241187,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -240456,9 +241248,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -240515,27 +241309,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -240759,8 +241555,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -240825,18 +241621,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -241703,57 +242500,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -241770,52 +242568,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -241890,7 +242687,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -242146,44 +242944,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -242216,31 +243013,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -242276,9 +243074,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -242335,27 +243135,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -242579,8 +243381,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -242645,18 +243447,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -243523,57 +244326,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -243590,52 +244394,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -243710,7 +244513,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -243966,44 +244770,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -244036,31 +244839,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -244096,9 +244900,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -244155,27 +244961,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -244399,8 +245207,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -244465,18 +245273,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -245343,57 +246152,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -245410,52 +246220,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -245530,7 +246339,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -245786,44 +246596,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -245856,31 +246665,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -245916,9 +246726,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -245975,27 +246787,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -246219,8 +247033,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -246285,18 +247099,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -247163,57 +247978,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -247230,52 +248046,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -247350,7 +248165,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -247606,44 +248422,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -247676,31 +248491,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -247736,9 +248552,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -247795,27 +248613,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -248039,8 +248859,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -248105,18 +248925,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -248983,57 +249804,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -249050,52 +249872,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -249170,7 +249991,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -249426,44 +250248,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -249496,31 +250317,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -249556,9 +250378,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -249615,27 +250439,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -249859,8 +250685,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -249925,18 +250751,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -250803,57 +251630,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -250870,52 +251698,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -250990,7 +251817,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -251246,44 +252074,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -251316,31 +252143,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -251376,9 +252204,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -251435,27 +252265,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -251679,8 +252511,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -251745,18 +252577,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -252623,57 +253456,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -252690,52 +253524,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -252810,7 +253643,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -253066,44 +253900,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -253136,31 +253969,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -253196,9 +254030,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -253255,27 +254091,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -253499,8 +254337,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -253565,18 +254403,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -254443,57 +255282,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -254510,52 +255350,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -254630,7 +255469,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -254886,44 +255726,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -254956,31 +255795,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -255016,9 +255856,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -255075,27 +255917,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -255319,8 +256163,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -255385,18 +256229,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -256263,57 +257108,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -256330,52 +257176,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -256450,7 +257295,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -256706,44 +257552,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -256776,31 +257621,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -256836,9 +257682,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -256895,27 +257743,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -257139,8 +257989,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -257205,18 +258055,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -258083,57 +258934,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -258150,52 +259002,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -258270,7 +259121,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -258526,44 +259378,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -258596,31 +259447,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -258656,9 +259508,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -258715,27 +259569,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -258959,8 +259815,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -259025,18 +259881,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -259903,57 +260760,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -259970,52 +260828,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -260090,7 +260947,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -260346,44 +261204,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -260416,31 +261273,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -260476,9 +261334,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -260535,27 +261395,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -260779,8 +261641,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -260845,18 +261707,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -261723,57 +262586,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -261790,52 +262654,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -261910,7 +262773,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -262166,44 +263030,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -262236,31 +263099,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -262296,9 +263160,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -262355,27 +263221,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -262599,8 +263467,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -262665,18 +263533,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -263543,57 +264412,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -263610,52 +264480,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -263730,7 +264599,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -263986,44 +264856,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -264056,31 +264925,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -264116,9 +264986,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -264175,27 +265047,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -264419,8 +265293,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -264485,18 +265359,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -265363,57 +266238,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -265430,52 +266306,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -265550,7 +266425,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -265806,44 +266682,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -265876,31 +266751,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -265936,9 +266812,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -265995,27 +266873,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -266239,8 +267119,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -266305,18 +267185,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -267183,57 +268064,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -267250,52 +268132,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -267370,7 +268251,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -267626,44 +268508,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -267696,31 +268577,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -267756,9 +268638,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -267815,27 +268699,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -268059,8 +268945,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -268125,18 +269011,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -269003,57 +269890,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -269070,52 +269958,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -269190,7 +270077,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -269446,44 +270334,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -269516,31 +270403,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -269576,9 +270464,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -269635,27 +270525,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -269879,8 +270771,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -269945,18 +270837,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -270823,57 +271716,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -270890,52 +271784,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -271010,7 +271903,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -271266,44 +272160,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -271336,31 +272229,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -271396,9 +272290,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -271455,27 +272351,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -271699,8 +272597,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -271765,18 +272663,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -272643,57 +273542,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -272710,52 +273610,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -272830,7 +273729,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -273086,44 +273986,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -273156,31 +274055,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -273216,9 +274116,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -273275,27 +274177,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -273519,8 +274423,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -273585,18 +274489,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -274463,57 +275368,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -274530,52 +275436,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -274650,7 +275555,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -274906,44 +275812,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -274976,31 +275881,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -275036,9 +275942,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -275095,27 +276003,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -275339,8 +276249,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -275405,18 +276315,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -276283,57 +277194,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -276350,52 +277262,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -276470,7 +277381,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -276726,44 +277638,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -276796,31 +277707,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -276856,9 +277768,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -276915,27 +277829,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -277159,8 +278075,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -277225,18 +278141,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -278103,57 +279020,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -278170,52 +279088,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -278290,7 +279207,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -278546,44 +279464,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -278616,31 +279533,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -278676,9 +279594,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -278735,27 +279655,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -278979,8 +279901,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -279045,18 +279967,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -279923,57 +280846,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -279990,52 +280914,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -280110,7 +281033,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -280366,44 +281290,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -280436,31 +281359,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -280496,9 +281420,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -280555,27 +281481,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -280799,8 +281727,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -280865,18 +281793,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -281743,57 +282672,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -281810,52 +282740,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -281930,7 +282859,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -282186,44 +283116,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -282256,31 +283185,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -282316,9 +283246,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -282375,27 +283307,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -282619,8 +283553,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -282685,18 +283619,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -283563,57 +284498,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -283630,52 +284566,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -283750,7 +284685,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -284006,44 +284942,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -284076,31 +285011,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -284136,9 +285072,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -284195,27 +285133,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -284439,8 +285379,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -284505,18 +285445,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -285383,57 +286324,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -285450,52 +286392,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -285570,7 +286511,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -285826,44 +286768,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -285896,31 +286837,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -285956,9 +286898,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -286015,27 +286959,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -286259,8 +287205,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -286325,18 +287271,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -287203,57 +288150,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -287270,52 +288218,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -287390,7 +288337,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -287646,44 +288594,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -287716,31 +288663,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -287776,9 +288724,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -287835,27 +288785,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -288079,8 +289031,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -288145,18 +289097,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -289023,57 +289976,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -289090,52 +290044,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -289210,7 +290163,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -289466,44 +290420,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -289536,31 +290489,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -289596,9 +290550,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -289655,27 +290611,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -289899,8 +290857,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -289965,18 +290923,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -290843,57 +291802,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -290910,52 +291870,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -291030,7 +291989,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -291286,44 +292246,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -291356,31 +292315,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -291416,9 +292376,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -291475,27 +292437,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -291719,8 +292683,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -291785,18 +292749,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -292663,57 +293628,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -292730,52 +293696,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -292850,7 +293815,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -293106,44 +294072,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -293176,31 +294141,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -293236,9 +294202,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -293295,27 +294263,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -293539,8 +294509,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -293605,18 +294575,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -294483,57 +295454,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -294550,52 +295522,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -294670,7 +295641,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -294926,44 +295898,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -294996,31 +295967,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -295056,9 +296028,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -295115,27 +296089,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -295359,8 +296335,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -295425,18 +296401,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -296303,57 +297280,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -296370,52 +297348,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -296490,7 +297467,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -296746,44 +297724,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -296816,31 +297793,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -296876,9 +297854,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -296935,27 +297915,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -297179,8 +298161,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -297245,18 +298227,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -298123,57 +299106,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -298190,52 +299174,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -298310,7 +299293,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -298566,44 +299550,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -298636,31 +299619,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -298696,9 +299680,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -298755,27 +299741,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -298999,8 +299987,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -299065,18 +300053,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -299943,57 +300932,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -300010,52 +301000,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -300130,7 +301119,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -300386,44 +301376,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -300456,31 +301445,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -300516,9 +301506,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -300575,27 +301567,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -300819,8 +301813,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -300885,18 +301879,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -301763,57 +302758,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -301830,52 +302826,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -301950,7 +302945,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -302206,44 +303202,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -302276,31 +303271,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -302336,9 +303332,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -302395,27 +303393,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -302639,8 +303639,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -302705,18 +303705,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -303583,57 +304584,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -303650,52 +304652,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -303770,7 +304771,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -304026,44 +305028,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -304096,31 +305097,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -304156,9 +305158,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -304215,27 +305219,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -304459,8 +305465,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -304525,18 +305531,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -305403,57 +306410,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -305470,52 +306478,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -305590,7 +306597,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -305846,44 +306854,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -305916,31 +306923,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -305976,9 +306984,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -306035,27 +307045,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -306279,8 +307291,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -306345,18 +307357,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -307223,57 +308236,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -307290,52 +308304,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -307410,7 +308423,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -307666,44 +308680,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -307736,31 +308749,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -307796,9 +308810,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -307855,27 +308871,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -308099,8 +309117,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -308165,18 +309183,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -309043,57 +310062,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -309110,52 +310130,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -309230,7 +310249,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -309486,44 +310506,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -309556,31 +310575,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -309616,9 +310636,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -309675,27 +310697,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -309919,8 +310943,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -309985,18 +311009,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -310863,57 +311888,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -310930,52 +311956,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -311050,7 +312075,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -311306,44 +312332,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -311376,31 +312401,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -311436,9 +312462,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -311495,27 +312523,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -311739,8 +312769,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -311805,18 +312835,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -312683,57 +313714,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -312750,52 +313782,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -312870,7 +313901,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -313126,44 +314158,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -313196,31 +314227,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -313256,9 +314288,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -313315,27 +314349,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -313559,8 +314595,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -313625,18 +314661,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -314503,57 +315540,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -314570,52 +315608,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -314690,7 +315727,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -314946,44 +315984,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -315016,31 +316053,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -315076,9 +316114,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -315135,27 +316175,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -315379,8 +316421,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -315445,18 +316487,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -316323,57 +317366,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -316390,52 +317434,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -316510,7 +317553,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -316766,44 +317810,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -316836,31 +317879,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -316896,9 +317940,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -316955,27 +318001,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -317199,8 +318247,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -317265,18 +318313,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -318143,57 +319192,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -318210,52 +319260,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -318330,7 +319379,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -318586,44 +319636,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -318656,31 +319705,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -318716,9 +319766,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -318775,27 +319827,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -319019,8 +320073,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -319085,18 +320139,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -319963,57 +321018,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -320030,52 +321086,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -320150,7 +321205,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -320406,44 +321462,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -320476,31 +321531,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -320536,9 +321592,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -320595,27 +321653,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -320839,8 +321899,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -320905,18 +321965,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -321783,57 +322844,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -321850,52 +322912,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -321970,7 +323031,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -322226,44 +323288,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -322296,31 +323357,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -322356,9 +323418,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -322415,27 +323479,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -322659,8 +323725,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -322725,18 +323791,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -323603,57 +324670,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -323670,52 +324738,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -323790,7 +324857,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -324046,44 +325114,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -324116,31 +325183,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -324176,9 +325244,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -324235,27 +325305,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -324479,8 +325551,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -324545,18 +325617,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -325423,57 +326496,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -325490,52 +326564,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -325610,7 +326683,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -325866,44 +326940,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -325936,31 +327009,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -325996,9 +327070,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -326055,27 +327131,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -326299,8 +327377,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -326365,18 +327443,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -327243,57 +328322,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -327310,52 +328390,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -327430,7 +328509,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -327686,44 +328766,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -327756,31 +328835,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -327816,9 +328896,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -327875,27 +328957,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -328119,8 +329203,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -328185,18 +329269,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -329063,57 +330148,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -329130,52 +330216,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -329250,7 +330335,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -329506,44 +330592,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -329576,31 +330661,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -329636,9 +330722,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -329695,27 +330783,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -329939,8 +331029,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -330005,18 +331095,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -330883,57 +331974,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -330950,52 +332042,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -331070,7 +332161,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -331326,44 +332418,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -331396,31 +332487,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -331456,9 +332548,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -331515,27 +332609,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -331759,8 +332855,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -331825,18 +332921,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -332703,57 +333800,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -332770,52 +333868,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -332890,7 +333987,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -333146,44 +334244,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -333216,31 +334313,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -333276,9 +334374,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -333335,27 +334435,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -333579,8 +334681,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -333645,18 +334747,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -334523,57 +335626,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -334590,52 +335694,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -334710,7 +335813,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -334966,44 +336070,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -335036,31 +336139,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -335096,9 +336200,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -335155,27 +336261,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -335399,8 +336507,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -335465,18 +336573,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -336343,57 +337452,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -336410,52 +337520,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -336530,7 +337639,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -336786,44 +337896,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -336856,31 +337965,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -336916,9 +338026,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -336975,27 +338087,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -337219,8 +338333,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -337285,18 +338399,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -338163,57 +339278,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -338230,52 +339346,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -338350,7 +339465,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -338606,44 +339722,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -338676,31 +339791,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -338736,9 +339852,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -338795,27 +339913,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -339039,8 +340159,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -339105,18 +340225,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -339983,57 +341104,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -340050,52 +341172,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -340170,7 +341291,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -340426,44 +341548,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -340496,31 +341617,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -340556,9 +341678,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -340615,27 +341739,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -340859,8 +341985,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -340925,18 +342051,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -341803,57 +342930,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -341870,52 +342998,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -341990,7 +343117,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -342246,44 +343374,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -342316,31 +343443,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -342376,9 +343504,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -342435,27 +343565,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -342679,8 +343811,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -342745,18 +343877,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -343623,57 +344756,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -343690,52 +344824,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -343810,7 +344943,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -344066,44 +345200,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -344136,31 +345269,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -344196,9 +345330,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -344255,27 +345391,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -344499,8 +345637,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -344565,18 +345703,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -345443,57 +346582,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -345510,52 +346650,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -345630,7 +346769,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -345886,44 +347026,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -345956,31 +347095,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -346016,9 +347156,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -346075,27 +347217,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -346319,8 +347463,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -346385,18 +347529,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -347263,57 +348408,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -347330,52 +348476,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -347450,7 +348595,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -347706,44 +348852,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -347776,31 +348921,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -347836,9 +348982,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -347895,27 +349043,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -348139,8 +349289,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -348205,18 +349355,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -349083,57 +350234,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -349150,52 +350302,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -349270,7 +350421,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -349526,44 +350678,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -349596,31 +350747,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -349656,9 +350808,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -349715,27 +350869,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -349959,8 +351115,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -350025,18 +351181,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -350903,57 +352060,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -350970,52 +352128,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -351090,7 +352247,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -351346,44 +352504,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -351416,31 +352573,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -351476,9 +352634,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -351535,27 +352695,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -351779,8 +352941,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -351845,18 +353007,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -352723,57 +353886,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -352790,52 +353954,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -352910,7 +354073,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -353166,44 +354330,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -353236,31 +354399,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -353296,9 +354460,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -353355,27 +354521,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -353599,8 +354767,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -353665,18 +354833,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -354543,57 +355712,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -354610,52 +355780,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -354730,7 +355899,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -354986,44 +356156,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -355056,31 +356225,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -355116,9 +356286,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -355175,27 +356347,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -355419,8 +356593,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -355485,18 +356659,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -356363,57 +357538,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -356430,52 +357606,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -356550,7 +357725,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -356806,44 +357982,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -356876,31 +358051,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -356936,9 +358112,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -356995,27 +358173,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -357239,8 +358419,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -357305,18 +358485,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -358183,57 +359364,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -358250,52 +359432,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -358370,7 +359551,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -358626,44 +359808,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -358696,31 +359877,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -358756,9 +359938,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -358815,27 +359999,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -359059,8 +360245,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -359125,18 +360311,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -360003,57 +361190,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -360070,52 +361258,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -360190,7 +361377,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -360446,44 +361634,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -360516,31 +361703,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -360576,9 +361764,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -360635,27 +361825,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -360879,8 +362071,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -360945,18 +362137,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -361823,57 +363016,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -361890,52 +363084,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -362010,7 +363203,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -362266,44 +363460,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -362336,31 +363529,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -362396,9 +363590,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -362455,27 +363651,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -362699,8 +363897,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -362765,18 +363963,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -363643,57 +364842,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -363710,52 +364910,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -363830,7 +365029,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -364086,44 +365286,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -364156,31 +365355,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -364216,9 +365416,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -364275,27 +365477,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -364519,8 +365723,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -364585,18 +365789,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -365463,57 +366668,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -365530,52 +366736,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -365650,7 +366855,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -365906,44 +367112,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -365976,31 +367181,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -366036,9 +367242,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -366095,27 +367303,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -366339,8 +367549,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -366405,18 +367615,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -367283,57 +368494,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -367350,52 +368562,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -367470,7 +368681,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -367726,44 +368938,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -367796,31 +369007,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -367856,9 +369068,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -367915,27 +369129,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -368159,8 +369375,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -368225,18 +369441,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -369103,57 +370320,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -369170,52 +370388,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -369290,7 +370507,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -369546,44 +370764,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -369616,31 +370833,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -369676,9 +370894,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -369735,27 +370955,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -369979,8 +371201,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -370045,18 +371267,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -370923,57 +372146,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -370990,52 +372214,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -371110,7 +372333,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -371366,44 +372590,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -371436,31 +372659,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -371496,9 +372720,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -371555,27 +372781,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -371799,8 +373027,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -371865,18 +373093,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -372743,57 +373972,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -372810,52 +374040,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -372930,7 +374159,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -373186,44 +374416,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -373256,31 +374485,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -373316,9 +374546,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -373375,27 +374607,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -373619,8 +374853,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -373685,18 +374919,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -374563,57 +375798,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -374630,52 +375866,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -374750,7 +375985,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -375006,44 +376242,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -375076,31 +376311,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -375136,9 +376372,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -375195,27 +376433,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -375439,8 +376679,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -375505,18 +376745,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -376383,57 +377624,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -376450,52 +377692,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -376570,7 +377811,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -376826,44 +378068,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -376896,31 +378137,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -376956,9 +378198,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -377015,27 +378259,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -377259,8 +378505,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -377325,18 +378571,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -378203,57 +379450,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -378270,52 +379518,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -378390,7 +379637,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -378646,44 +379894,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -378716,31 +379963,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -378776,9 +380024,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -378835,27 +380085,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -379079,8 +380331,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -379145,18 +380397,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -380023,57 +381276,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -380090,52 +381344,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -380210,7 +381463,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -380466,44 +381720,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -380536,31 +381789,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -380596,9 +381850,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -380655,27 +381911,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -380899,8 +382157,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -380965,18 +382223,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -381843,57 +383102,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -381910,52 +383170,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -382030,7 +383289,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -382286,44 +383546,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -382356,31 +383615,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -382416,9 +383676,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -382475,27 +383737,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -382719,8 +383983,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -382785,18 +384049,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -383663,57 +384928,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -383730,52 +384996,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -383850,7 +385115,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -384106,44 +385372,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -384176,31 +385441,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -384236,9 +385502,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -384295,27 +385563,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -384539,8 +385809,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -384605,18 +385875,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -385483,57 +386754,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -385550,52 +386822,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -385670,7 +386941,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -385926,44 +387198,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -385996,31 +387267,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -386056,9 +387328,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -386115,27 +387389,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -386359,8 +387635,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -386425,18 +387701,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -387303,57 +388580,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -387370,52 +388648,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -387490,7 +388767,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -387746,44 +389024,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -387816,31 +389093,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -387876,9 +389154,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -387935,27 +389215,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -388179,8 +389461,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -388245,18 +389527,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -389123,57 +390406,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -389190,52 +390474,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -389310,7 +390593,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -389566,44 +390850,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -389636,31 +390919,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -389696,9 +390980,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -389755,27 +391041,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -389999,8 +391287,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -390065,18 +391353,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -390943,57 +392232,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -391010,52 +392300,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -391130,7 +392419,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -391386,44 +392676,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -391456,31 +392745,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -391516,9 +392806,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -391575,27 +392867,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -391819,8 +393113,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -391885,18 +393179,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -392763,57 +394058,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -392830,52 +394126,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -392950,7 +394245,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -393206,44 +394502,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -393276,31 +394571,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -393336,9 +394632,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -393395,27 +394693,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -393639,8 +394939,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -393705,18 +395005,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -394583,57 +395884,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -394650,52 +395952,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -394770,7 +396071,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -395026,44 +396328,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -395096,31 +396397,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -395156,9 +396458,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -395215,27 +396519,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -395459,8 +396765,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -395525,18 +396831,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -396403,57 +397710,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -396470,52 +397778,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -396590,7 +397897,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -396846,44 +398154,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -396916,31 +398223,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -396976,9 +398284,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -397035,27 +398345,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -397279,8 +398591,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -397345,18 +398657,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -398223,57 +399536,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -398290,52 +399604,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -398410,7 +399723,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -398666,44 +399980,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -398736,31 +400049,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -398796,9 +400110,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -398855,27 +400171,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -399099,8 +400417,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -399165,18 +400483,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -400043,57 +401362,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -400110,52 +401430,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -400230,7 +401549,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -400486,44 +401806,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -400556,31 +401875,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -400616,9 +401936,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -400675,27 +401997,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -400919,8 +402243,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -400985,18 +402309,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -401863,57 +403188,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -401930,52 +403256,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -402050,7 +403375,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -402306,44 +403632,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -402376,31 +403701,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -402436,9 +403762,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -402495,27 +403823,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -402739,8 +404069,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -402805,18 +404135,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -403683,57 +405014,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -403750,52 +405082,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -403870,7 +405201,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -404126,44 +405458,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -404196,31 +405527,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -404256,9 +405588,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -404315,27 +405649,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -404559,8 +405895,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -404625,18 +405961,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -405503,57 +406840,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -405570,52 +406908,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -405690,7 +407027,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -405946,44 +407284,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -406016,31 +407353,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -406076,9 +407414,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -406135,27 +407475,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -406379,8 +407721,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -406445,18 +407787,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -407323,57 +408666,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -407390,52 +408734,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -407510,7 +408853,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -407766,44 +409110,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -407836,31 +409179,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -407896,9 +409240,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -407955,27 +409301,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -408199,8 +409547,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -408265,18 +409613,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -409143,57 +410492,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -409210,52 +410560,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -409330,7 +410679,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -409586,44 +410936,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -409656,31 +411005,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -409716,9 +411066,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -409775,27 +411127,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -410019,8 +411373,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -410085,18 +411439,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -410963,57 +412318,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -411030,52 +412386,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -411150,7 +412505,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -411406,44 +412762,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -411476,31 +412831,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -411536,9 +412892,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -411595,27 +412953,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -411839,8 +413199,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -411905,18 +413265,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -412783,57 +414144,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -412850,52 +414212,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -412970,7 +414331,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -413226,44 +414588,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -413296,31 +414657,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -413356,9 +414718,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -413415,27 +414779,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -413659,8 +415025,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -413725,18 +415091,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -414603,57 +415970,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -414670,52 +416038,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -414790,7 +416157,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -415046,44 +416414,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -415116,31 +416483,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -415176,9 +416544,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -415235,27 +416605,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -415479,8 +416851,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -415545,18 +416917,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -416423,57 +417796,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -416490,52 +417864,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -416610,7 +417983,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -416866,44 +418240,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -416936,31 +418309,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -416996,9 +418370,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -417055,27 +418431,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -417299,8 +418677,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -417365,18 +418743,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -418243,57 +419622,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -418310,52 +419690,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -418430,7 +419809,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -418686,44 +420066,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -418756,31 +420135,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -418816,9 +420196,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -418875,27 +420257,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -419119,8 +420503,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -419185,18 +420569,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -420063,57 +421448,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -420130,52 +421516,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -420250,7 +421635,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -420506,44 +421892,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -420576,31 +421961,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -420636,9 +422022,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -420695,27 +422083,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -420939,8 +422329,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -421005,18 +422395,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -421883,57 +423274,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -421950,52 +423342,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -422070,7 +423461,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -422326,44 +423718,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -422396,31 +423787,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -422456,9 +423848,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -422515,27 +423909,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -422759,8 +424155,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -422825,18 +424221,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -423703,57 +425100,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -423770,52 +425168,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -423890,7 +425287,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -424146,44 +425544,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -424216,31 +425613,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -424276,9 +425674,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -424335,27 +425735,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -424579,8 +425981,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -424645,18 +426047,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -425523,57 +426926,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -425590,52 +426994,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -425710,7 +427113,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -425966,44 +427370,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -426036,31 +427439,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -426096,9 +427500,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -426155,27 +427561,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -426399,8 +427807,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -426465,18 +427873,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -427343,57 +428752,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -427410,52 +428820,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -427530,7 +428939,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -427786,44 +429196,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -427856,31 +429265,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -427916,9 +429326,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -427975,27 +429387,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -428219,8 +429633,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -428285,18 +429699,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -429163,57 +430578,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -429230,52 +430646,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -429350,7 +430765,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -429606,44 +431022,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -429676,31 +431091,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -429736,9 +431152,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -429795,27 +431213,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -430039,8 +431459,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -430105,18 +431525,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -430983,57 +432404,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -431050,52 +432472,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -431170,7 +432591,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -431426,44 +432848,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -431496,31 +432917,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -431556,9 +432978,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -431615,27 +433039,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -431859,8 +433285,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -431925,18 +433351,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -432803,57 +434230,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -432870,52 +434298,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -432990,7 +434417,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -433246,44 +434674,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -433316,31 +434743,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -433376,9 +434804,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -433435,27 +434865,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -433679,8 +435111,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -433745,18 +435177,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -434623,57 +436056,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -434690,52 +436124,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -434810,7 +436243,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -435066,44 +436500,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -435136,31 +436569,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -435196,9 +436630,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -435255,27 +436691,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -435499,8 +436937,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -435565,18 +437003,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -436443,57 +437882,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -436510,52 +437950,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -436630,7 +438069,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -436886,44 +438326,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -436956,31 +438395,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -437016,9 +438456,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -437075,27 +438517,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -437319,8 +438763,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -437385,18 +438829,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -438263,57 +439708,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -438330,52 +439776,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -438450,7 +439895,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -438706,44 +440152,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -438776,31 +440221,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -438836,9 +440282,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -438895,27 +440343,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -439139,8 +440589,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -439205,18 +440655,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -440083,57 +441534,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -440150,52 +441602,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -440270,7 +441721,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -440526,44 +441978,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -440596,31 +442047,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -440656,9 +442108,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -440715,27 +442169,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -440959,8 +442415,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -441025,18 +442481,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -441903,57 +443360,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -441970,52 +443428,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -442090,7 +443547,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -442346,44 +443804,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -442416,31 +443873,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -442476,9 +443934,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -442535,27 +443995,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -442779,8 +444241,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -442845,18 +444307,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -443723,57 +445186,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -443790,52 +445254,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -443910,7 +445373,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -444166,44 +445630,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -444236,31 +445699,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -444296,9 +445760,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -444355,27 +445821,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -444599,8 +446067,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -444665,18 +446133,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -445543,57 +447012,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -445610,52 +447080,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -445730,7 +447199,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -445986,44 +447456,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -446056,31 +447525,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -446116,9 +447586,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -446175,27 +447647,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -446419,8 +447893,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -446485,18 +447959,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -447363,57 +448838,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -447430,52 +448906,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -447550,7 +449025,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -447806,44 +449282,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -447876,31 +449351,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -447936,9 +449412,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -447995,27 +449473,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -448239,8 +449719,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -448305,18 +449785,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -449183,57 +450664,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -449250,52 +450732,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -449370,7 +450851,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -449626,44 +451108,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -449696,31 +451177,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -449756,9 +451238,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -449815,27 +451299,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -450059,8 +451545,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -450125,18 +451611,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -451003,57 +452490,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -451070,52 +452558,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -451190,7 +452677,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -451446,44 +452934,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -451516,31 +453003,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -451576,9 +453064,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -451635,27 +453125,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -451879,8 +453371,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -451945,18 +453437,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -452823,57 +454316,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -452890,52 +454384,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -453010,7 +454503,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -453266,44 +454760,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -453336,31 +454829,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -453396,9 +454890,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -453455,27 +454951,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -453699,8 +455197,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -453765,18 +455263,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -454643,57 +456142,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -454710,52 +456210,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -454830,7 +456329,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -455086,44 +456586,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -455156,31 +456655,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -455216,9 +456716,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -455275,27 +456777,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -455519,8 +457023,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -455585,18 +457089,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -456463,57 +457968,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -456530,52 +458036,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -456650,7 +458155,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -456906,44 +458412,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -456976,31 +458481,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -457036,9 +458542,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -457095,27 +458603,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -457339,8 +458849,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -457405,18 +458915,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -458283,57 +459794,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -458350,52 +459862,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -458470,7 +459981,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -458726,44 +460238,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -458796,31 +460307,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -458856,9 +460368,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -458915,27 +460429,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -459159,8 +460675,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -459225,18 +460741,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -460103,57 +461620,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -460170,52 +461688,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -460290,7 +461807,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -460546,44 +462064,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -460616,31 +462133,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -460676,9 +462194,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -460735,27 +462255,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -460979,8 +462501,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -461045,18 +462567,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -461923,57 +463446,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -461990,52 +463514,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -462110,7 +463633,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -462366,44 +463890,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -462436,31 +463959,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -462496,9 +464020,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -462555,27 +464081,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -462799,8 +464327,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -462865,18 +464393,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -463743,57 +465272,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -463810,52 +465340,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -463930,7 +465459,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -464186,44 +465716,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -464256,31 +465785,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -464316,9 +465846,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -464375,27 +465907,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -464619,8 +466153,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -464685,18 +466219,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -465563,57 +467098,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -465630,52 +467166,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -465750,7 +467285,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -466006,44 +467542,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -466076,31 +467611,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -466136,9 +467672,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -466195,27 +467733,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -466439,8 +467979,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -466505,18 +468045,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -467383,57 +468924,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -467450,52 +468992,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -467570,7 +469111,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -467826,44 +469368,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -467896,31 +469437,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -467956,9 +469498,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -468015,27 +469559,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -468259,8 +469805,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -468325,18 +469871,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -469203,57 +470750,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -469270,52 +470818,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -469390,7 +470937,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -469646,44 +471194,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -469716,31 +471263,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -469776,9 +471324,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -469835,27 +471385,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -470079,8 +471631,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -470145,18 +471697,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -471023,57 +472576,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -471090,52 +472644,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -471210,7 +472763,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -471466,44 +473020,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -471536,31 +473089,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -471596,9 +473150,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -471655,27 +473211,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -471899,8 +473457,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -471965,18 +473523,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -472843,57 +474402,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -472910,52 +474470,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -473030,7 +474589,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -473286,44 +474846,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -473356,31 +474915,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -473416,9 +474976,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -473475,27 +475037,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -473719,8 +475283,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -473785,18 +475349,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -474663,57 +476228,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -474730,52 +476296,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -474850,7 +476415,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -475106,44 +476672,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -475176,31 +476741,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -475236,9 +476802,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -475295,27 +476863,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -475539,8 +477109,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -475605,18 +477175,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -476483,57 +478054,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -476550,52 +478122,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -476670,7 +478241,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -476926,44 +478498,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -476996,31 +478567,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -477056,9 +478628,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -477115,27 +478689,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -477359,8 +478935,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -477425,18 +479001,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -478303,57 +479880,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -478370,52 +479948,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -478490,7 +480067,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -478746,44 +480324,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -478816,31 +480393,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -478876,9 +480454,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -478935,27 +480515,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -479179,8 +480761,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -479245,18 +480827,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -480123,57 +481706,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -480190,52 +481774,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -480310,7 +481893,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -480566,44 +482150,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -480636,31 +482219,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -480696,9 +482280,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -480755,27 +482341,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -480999,8 +482587,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -481065,18 +482653,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -481943,57 +483532,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -482010,52 +483600,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -482130,7 +483719,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -482386,44 +483976,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -482456,31 +484045,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -482516,9 +484106,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -482575,27 +484167,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -482819,8 +484413,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -482885,18 +484479,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -483763,57 +485358,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -483830,52 +485426,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -483950,7 +485545,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -484206,44 +485802,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -484276,31 +485871,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -484336,9 +485932,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -484395,27 +485993,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -484639,8 +486239,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -484705,18 +486305,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -485583,57 +487184,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -485650,52 +487252,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -485770,7 +487371,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -486026,44 +487628,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -486096,31 +487697,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -486156,9 +487758,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -486215,27 +487819,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -486459,8 +488065,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -486525,18 +488131,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -487403,57 +489010,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -487470,52 +489078,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -487590,7 +489197,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -487846,44 +489454,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -487916,31 +489523,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -487976,9 +489584,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -488035,27 +489645,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -488279,8 +489891,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -488345,18 +489957,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -489223,57 +490836,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -489290,52 +490904,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -489410,7 +491023,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -489666,44 +491280,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -489736,31 +491349,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -489796,9 +491410,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -489855,27 +491471,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -490099,8 +491717,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -490165,18 +491783,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -491043,57 +492662,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -491110,52 +492730,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -491230,7 +492849,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -491486,44 +493106,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -491556,31 +493175,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -491616,9 +493236,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -491675,27 +493297,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -491919,8 +493543,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -491985,18 +493609,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -492863,57 +494488,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -492930,52 +494556,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -493050,7 +494675,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -493306,44 +494932,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -493376,31 +495001,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -493436,9 +495062,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -493495,27 +495123,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -493739,8 +495369,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -493805,18 +495435,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -494683,57 +496314,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -494750,52 +496382,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -494870,7 +496501,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -495126,44 +496758,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -495196,31 +496827,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -495256,9 +496888,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -495315,27 +496949,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -495559,8 +497195,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -495625,18 +497261,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -496503,57 +498140,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -496570,52 +498208,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -496690,7 +498327,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -496946,44 +498584,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -497016,31 +498653,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -497076,9 +498714,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -497135,27 +498775,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -497379,8 +499021,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -497445,18 +499087,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -498323,57 +499966,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -498390,52 +500034,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -498510,7 +500153,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -498766,44 +500410,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -498836,31 +500479,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -498896,9 +500540,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -498955,27 +500601,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -499199,8 +500847,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -499265,18 +500913,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -500143,57 +501792,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -500210,52 +501860,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -500330,7 +501979,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -500586,44 +502236,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -500656,31 +502305,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -500716,9 +502366,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -500775,27 +502427,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -501019,8 +502673,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -501085,18 +502739,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -501963,57 +503618,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -502030,52 +503686,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -502150,7 +503805,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -502406,44 +504062,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -502476,31 +504131,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -502536,9 +504192,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -502595,27 +504253,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -502839,8 +504499,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -502905,18 +504565,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -503783,57 +505444,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -503850,52 +505512,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -503970,7 +505631,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -504226,44 +505888,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -504296,31 +505957,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -504356,9 +506018,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -504415,27 +506079,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -504659,8 +506325,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -504725,18 +506391,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -505603,57 +507270,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -505670,52 +507338,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -505790,7 +507457,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -506046,44 +507714,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -506116,31 +507783,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -506176,9 +507844,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -506235,27 +507905,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -506479,8 +508151,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -506545,18 +508217,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -507423,57 +509096,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -507490,52 +509164,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -507610,7 +509283,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -507866,44 +509540,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -507936,31 +509609,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -507996,9 +509670,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -508055,27 +509731,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -508299,8 +509977,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -508365,18 +510043,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -509243,57 +510922,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -509310,52 +510990,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -509430,7 +511109,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -509686,44 +511366,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -509756,31 +511435,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -509816,9 +511496,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -509875,27 +511557,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -510119,8 +511803,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -510185,18 +511869,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -511063,57 +512748,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -511130,52 +512816,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -511250,7 +512935,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -511506,44 +513192,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -511576,31 +513261,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -511636,9 +513322,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -511695,27 +513383,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -511939,8 +513629,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -512005,18 +513695,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -512883,57 +514574,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -512950,52 +514642,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -513070,7 +514761,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -513326,44 +515018,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -513396,31 +515087,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -513456,9 +515148,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -513515,27 +515209,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -513759,8 +515455,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -513825,18 +515521,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -514703,57 +516400,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -514770,52 +516468,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -514890,7 +516587,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -515146,44 +516844,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -515216,31 +516913,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -515276,9 +516974,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -515335,27 +517035,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -515579,8 +517281,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -515645,18 +517347,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -516523,57 +518226,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -516590,52 +518294,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -516710,7 +518413,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -516966,44 +518670,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -517036,31 +518739,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -517096,9 +518800,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -517155,27 +518861,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -517399,8 +519107,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -517465,18 +519173,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -518343,57 +520052,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -518410,52 +520120,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -518530,7 +520239,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -518786,44 +520496,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -518856,31 +520565,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -518916,9 +520626,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -518975,27 +520687,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -519219,8 +520933,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -519285,18 +520999,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -520163,57 +521878,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -520230,52 +521946,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -520350,7 +522065,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -520606,44 +522322,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -520676,31 +522391,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -520736,9 +522452,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -520795,27 +522513,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -521039,8 +522759,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -521105,18 +522825,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -521983,57 +523704,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -522050,52 +523772,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -522170,7 +523891,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -522426,44 +524148,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -522496,31 +524217,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -522556,9 +524278,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -522615,27 +524339,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -522859,8 +524585,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -522925,18 +524651,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -523803,57 +525530,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -523870,52 +525598,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -523990,7 +525717,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -524246,44 +525974,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -524316,31 +526043,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -524376,9 +526104,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -524435,27 +526165,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -524679,8 +526411,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -524745,18 +526477,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -525623,57 +527356,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -525690,52 +527424,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -525810,7 +527543,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -526066,44 +527800,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -526136,31 +527869,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -526196,9 +527930,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -526255,27 +527991,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -526499,8 +528237,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -526565,18 +528303,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -527443,57 +529182,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -527510,52 +529250,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -527630,7 +529369,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -527886,44 +529626,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -527956,31 +529695,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -528016,9 +529756,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -528075,27 +529817,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -528319,8 +530063,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -528385,18 +530129,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -529263,57 +531008,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -529330,52 +531076,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -529450,7 +531195,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -529706,44 +531452,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -529776,31 +531521,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -529836,9 +531582,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -529895,27 +531643,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -530139,8 +531889,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -530205,18 +531955,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -531083,57 +532834,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -531150,52 +532902,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -531270,7 +533021,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -531526,44 +533278,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -531596,31 +533347,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -531656,9 +533408,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -531715,27 +533469,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -531959,8 +533715,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -532025,18 +533781,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -532903,57 +534660,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -532970,52 +534728,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -533090,7 +534847,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -533346,44 +535104,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -533416,31 +535173,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -533476,9 +535234,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -533535,27 +535295,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -533779,8 +535541,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -533845,18 +535607,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -534723,57 +536486,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -534790,52 +536554,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -534910,7 +536673,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -535166,44 +536930,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -535236,31 +536999,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -535296,9 +537060,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -535355,27 +537121,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -535599,8 +537367,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -535665,18 +537433,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -536543,57 +538312,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -536610,52 +538380,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -536730,7 +538499,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -536986,44 +538756,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -537056,31 +538825,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -537116,9 +538886,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -537175,27 +538947,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -537419,8 +539193,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -537485,18 +539259,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -538363,57 +540138,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -538430,52 +540206,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -538550,7 +540325,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -538806,44 +540582,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -538876,31 +540651,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -538936,9 +540712,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -538995,27 +540773,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -539239,8 +541019,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -539305,18 +541085,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -540183,57 +541964,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -540250,52 +542032,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -540370,7 +542151,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -540626,44 +542408,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -540696,31 +542477,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -540756,9 +542538,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -540815,27 +542599,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -541059,8 +542845,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -541125,18 +542911,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -542003,57 +543790,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -542070,52 +543858,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -542190,7 +543977,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -542446,44 +544234,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -542516,31 +544303,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -542576,9 +544364,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -542635,27 +544425,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -542879,8 +544671,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -542945,18 +544737,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -543823,57 +545616,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -543890,52 +545684,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -544010,7 +545803,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -544266,44 +546060,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -544336,31 +546129,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -544396,9 +546190,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -544455,27 +546251,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -544699,8 +546497,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -544765,18 +546563,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -545643,57 +547442,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -545710,52 +547510,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -545830,7 +547629,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -546086,44 +547886,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -546156,31 +547955,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -546216,9 +548016,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -546275,27 +548077,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -546519,8 +548323,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -546585,18 +548389,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -547463,57 +549268,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -547530,52 +549336,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -547650,7 +549455,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -547906,44 +549712,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -547976,31 +549781,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -548036,9 +549842,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -548095,27 +549903,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -548339,8 +550149,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -548405,18 +550215,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -549283,57 +551094,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -549350,52 +551162,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -549470,7 +551281,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -549726,44 +551538,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -549796,31 +551607,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -549856,9 +551668,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -549915,27 +551729,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -550159,8 +551975,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -550225,18 +552041,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -551103,57 +552920,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -551170,52 +552988,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -551290,7 +553107,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -551546,44 +553364,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -551616,31 +553433,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -551676,9 +553494,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -551735,27 +553555,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -551979,8 +553801,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -552045,18 +553867,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -552923,57 +554746,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -552990,52 +554814,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -553110,7 +554933,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -553366,44 +555190,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -553436,31 +555259,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -553496,9 +555320,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -553555,27 +555381,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -553799,8 +555627,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -553865,18 +555693,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -554743,57 +556572,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -554810,52 +556640,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -554930,7 +556759,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -555186,44 +557016,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -555256,31 +557085,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -555316,9 +557146,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -555375,27 +557207,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -555619,8 +557453,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -555685,18 +557519,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -556563,57 +558398,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -556630,52 +558466,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -556750,7 +558585,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -557006,44 +558842,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -557076,31 +558911,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -557136,9 +558972,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -557195,27 +559033,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -557439,8 +559279,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -557505,18 +559345,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -558383,57 +560224,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -558450,52 +560292,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -558570,7 +560411,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -558826,44 +560668,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -558896,31 +560737,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -558956,9 +560798,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -559015,27 +560859,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -559259,8 +561105,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -559325,18 +561171,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -560203,57 +562050,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -560270,52 +562118,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -560390,7 +562237,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -560646,44 +562494,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -560716,31 +562563,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -560776,9 +562624,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -560835,27 +562685,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -561079,8 +562931,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -561145,18 +562997,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -562023,57 +563876,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -562090,52 +563944,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -562210,7 +564063,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -562466,44 +564320,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -562536,31 +564389,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -562596,9 +564450,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -562655,27 +564511,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -562899,8 +564757,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -562965,18 +564823,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -563843,57 +565702,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -563910,52 +565770,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -564030,7 +565889,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -564286,44 +566146,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -564356,31 +566215,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -564416,9 +566276,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -564475,27 +566337,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -564719,8 +566583,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -564785,18 +566649,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -565663,57 +567528,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -565730,52 +567596,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -565850,7 +567715,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -566106,44 +567972,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -566176,31 +568041,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -566236,9 +568102,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -566295,27 +568163,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -566539,8 +568409,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -566605,18 +568475,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -567483,57 +569354,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -567550,52 +569422,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -567670,7 +569541,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -567926,44 +569798,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -567996,31 +569867,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -568056,9 +569928,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -568115,27 +569989,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -568359,8 +570235,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -568425,18 +570301,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -569303,57 +571180,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -569370,52 +571248,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -569490,7 +571367,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -569746,44 +571624,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -569816,31 +571693,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -569876,9 +571754,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -569935,27 +571815,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -570179,8 +572061,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -570245,18 +572127,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -571123,57 +573006,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -571190,52 +573074,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -571310,7 +573193,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -571566,44 +573450,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -571636,31 +573519,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -571696,9 +573580,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -571755,27 +573641,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -571999,8 +573887,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -572065,18 +573953,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -572943,57 +574832,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -573010,52 +574900,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -573130,7 +575019,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -573386,44 +575276,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -573456,31 +575345,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -573516,9 +575406,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -573575,27 +575467,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -573819,8 +575713,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -573885,18 +575779,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -574763,57 +576658,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -574830,52 +576726,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -574950,7 +576845,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -575206,44 +577102,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -575276,31 +577171,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -575336,9 +577232,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -575395,27 +577293,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -575639,8 +577539,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -575705,18 +577605,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -576583,57 +578484,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -576650,52 +578552,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -576770,7 +578671,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -577026,44 +578928,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -577096,31 +578997,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -577156,9 +579058,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -577215,27 +579119,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -577459,8 +579365,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -577525,18 +579431,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -578403,57 +580310,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -578470,52 +580378,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -578590,7 +580497,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -578846,44 +580754,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -578916,31 +580823,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -578976,9 +580884,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -579035,27 +580945,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -579279,8 +581191,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -579345,18 +581257,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -580223,57 +582136,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -580290,52 +582204,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -580410,7 +582323,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -580666,44 +582580,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -580736,31 +582649,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -580796,9 +582710,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -580855,27 +582771,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -581099,8 +583017,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -581165,18 +583083,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -582043,57 +583962,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -582110,52 +584030,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -582230,7 +584149,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -582486,44 +584406,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -582556,31 +584475,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -582616,9 +584536,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -582675,27 +584597,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -582919,8 +584843,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -582985,18 +584909,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -583863,57 +585788,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -583930,52 +585856,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -584050,7 +585975,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -584306,44 +586232,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -584376,31 +586301,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -584436,9 +586362,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -584495,27 +586423,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -584739,8 +586669,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -584805,18 +586735,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -585683,57 +587614,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -585750,52 +587682,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -585870,7 +587801,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -586126,44 +588058,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -586196,31 +588127,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -586256,9 +588188,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -586315,27 +588249,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -586559,8 +588495,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -586625,18 +588561,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -587503,57 +589440,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -587570,52 +589508,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -587690,7 +589627,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -587946,44 +589884,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -588016,31 +589953,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -588076,9 +590014,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -588135,27 +590075,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -588379,8 +590321,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -588445,18 +590387,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -589323,57 +591266,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -589390,52 +591334,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -589510,7 +591453,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -589766,44 +591710,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -589836,31 +591779,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -589896,9 +591840,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -589955,27 +591901,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -590199,8 +592147,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -590265,18 +592213,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -591143,57 +593092,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -591210,52 +593160,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -591330,7 +593279,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -591586,44 +593536,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -591656,31 +593605,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -591716,9 +593666,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -591775,27 +593727,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -592019,8 +593973,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -592085,18 +594039,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -592963,57 +594918,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -593030,52 +594986,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -593150,7 +595105,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -593406,44 +595362,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -593476,31 +595431,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -593536,9 +595492,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -593595,27 +595553,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -593839,8 +595799,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -593905,18 +595865,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -594783,57 +596744,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -594850,52 +596812,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -594970,7 +596931,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -595226,44 +597188,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -595296,31 +597257,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -595356,9 +597318,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -595415,27 +597379,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -595659,8 +597625,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -595725,18 +597691,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -596603,57 +598570,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -596670,52 +598638,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -596790,7 +598757,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -597046,44 +599014,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -597116,31 +599083,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -597176,9 +599144,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -597235,27 +599205,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -597479,8 +599451,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -597545,18 +599517,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -598423,57 +600396,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -598490,52 +600464,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -598610,7 +600583,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -598866,44 +600840,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -598936,31 +600909,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -598996,9 +600970,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -599055,27 +601031,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -599299,8 +601277,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -599365,18 +601343,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -600243,57 +602222,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -600310,52 +602290,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -600430,7 +602409,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -600686,44 +602666,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -600756,31 +602735,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -600816,9 +602796,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -600875,27 +602857,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -601119,8 +603103,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -601185,18 +603169,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -602063,57 +604048,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -602130,52 +604116,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -602250,7 +604235,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -602506,44 +604492,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -602576,31 +604561,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -602636,9 +604622,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -602695,27 +604683,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -602939,8 +604929,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -603005,18 +604995,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -603883,57 +605874,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -603950,52 +605942,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -604070,7 +606061,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -604326,44 +606318,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -604396,31 +606387,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -604456,9 +606448,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -604515,27 +606509,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -604759,8 +606755,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -604825,18 +606821,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -605703,57 +607700,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -605770,52 +607768,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -605890,7 +607887,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -606146,44 +608144,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -606216,31 +608213,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -606276,9 +608274,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -606335,27 +608335,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -606579,8 +608581,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -606645,18 +608647,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -607523,57 +609526,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -607590,52 +609594,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -607710,7 +609713,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -607966,44 +609970,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -608036,31 +610039,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -608096,9 +610100,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -608155,27 +610161,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -608399,8 +610407,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -608465,18 +610473,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -609343,57 +611352,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -609410,52 +611420,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -609530,7 +611539,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -609786,44 +611796,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -609856,31 +611865,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -609916,9 +611926,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -609975,27 +611987,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -610219,8 +612233,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -610285,18 +612299,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -611163,57 +613178,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -611230,52 +613246,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -611350,7 +613365,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -611606,44 +613622,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -611676,31 +613691,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -611736,9 +613752,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -611795,27 +613813,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -612039,8 +614059,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -612105,18 +614125,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -612983,57 +615004,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -613050,52 +615072,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -613170,7 +615191,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -613426,44 +615448,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -613496,31 +615517,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -613556,9 +615578,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -613615,27 +615639,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -613859,8 +615885,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -613925,18 +615951,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -614803,57 +616830,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -614870,52 +616898,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -614990,7 +617017,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -615246,44 +617274,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -615316,31 +617343,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -615376,9 +617404,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -615435,27 +617465,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -615679,8 +617711,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -615745,18 +617777,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -616623,57 +618656,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -616690,52 +618724,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -616810,7 +618843,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -617066,44 +619100,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -617136,31 +619169,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -617196,9 +619230,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -617255,27 +619291,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -617499,8 +619537,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -617565,18 +619603,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -618443,57 +620482,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -618510,52 +620550,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -618630,7 +620669,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -618886,44 +620926,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -618956,31 +620995,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -619016,9 +621056,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -619075,27 +621117,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -619319,8 +621363,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -619385,18 +621429,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -620263,57 +622308,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -620330,52 +622376,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -620450,7 +622495,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -620706,44 +622752,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -620776,31 +622821,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -620836,9 +622882,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -620895,27 +622943,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -621139,8 +623189,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -621205,18 +623255,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -622083,57 +624134,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -622150,52 +624202,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -622270,7 +624321,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -622526,44 +624578,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -622596,31 +624647,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -622656,9 +624708,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -622715,27 +624769,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -622959,8 +625015,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -623025,18 +625081,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -623903,57 +625960,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -623970,52 +626028,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -624090,7 +626147,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -624346,44 +626404,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -624416,31 +626473,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -624476,9 +626534,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -624535,27 +626595,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -624779,8 +626841,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -624845,18 +626907,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -625723,57 +627786,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -625790,52 +627854,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -625910,7 +627973,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -626166,44 +628230,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -626236,31 +628299,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -626296,9 +628360,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -626355,27 +628421,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -626599,8 +628667,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -626665,18 +628733,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -627543,57 +629612,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -627610,52 +629680,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -627730,7 +629799,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -627986,44 +630056,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -628056,31 +630125,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -628116,9 +630186,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -628175,27 +630247,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -628419,8 +630493,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -628485,18 +630559,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -629363,57 +631438,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -629430,52 +631506,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -629550,7 +631625,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -629806,44 +631882,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -629876,31 +631951,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -629936,9 +632012,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -629995,27 +632073,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -630239,8 +632319,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -630305,18 +632385,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -631183,57 +633264,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -631250,52 +633332,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -631370,7 +633451,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -631626,44 +633708,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -631696,31 +633777,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -631756,9 +633838,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -631815,27 +633899,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -632059,8 +634145,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -632125,18 +634211,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -633003,57 +635090,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -633070,52 +635158,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -633190,7 +635277,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -633446,44 +635534,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -633516,31 +635603,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -633576,9 +635664,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -633635,27 +635725,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -633879,8 +635971,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -633945,18 +636037,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -634823,57 +636916,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -634890,52 +636984,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -635010,7 +637103,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -635266,44 +637360,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -635336,31 +637429,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -635396,9 +637490,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -635455,27 +637551,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -635699,8 +637797,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -635765,18 +637863,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -636643,57 +638742,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -636710,52 +638810,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -636830,7 +638929,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -637086,44 +639186,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -637156,31 +639255,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -637216,9 +639316,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -637275,27 +639377,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -637519,8 +639623,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -637585,18 +639689,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -638463,57 +640568,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -638530,52 +640636,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -638650,7 +640755,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -638906,44 +641012,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -638976,31 +641081,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -639036,9 +641142,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -639095,27 +641203,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -639339,8 +641449,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -639405,18 +641515,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -640283,57 +642394,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -640350,52 +642462,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -640470,7 +642581,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -640726,44 +642838,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -640796,31 +642907,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -640856,9 +642968,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -640915,27 +643029,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -641159,8 +643275,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -641225,18 +643341,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -642103,57 +644220,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -642170,52 +644288,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -642290,7 +644407,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -642546,44 +644664,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -642616,31 +644733,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -642676,9 +644794,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -642735,27 +644855,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -642979,8 +645101,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -643045,18 +645167,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -643923,57 +646046,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -643990,52 +646114,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -644110,7 +646233,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -644366,44 +646490,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -644436,31 +646559,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -644496,9 +646620,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -644555,27 +646681,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -644799,8 +646927,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -644865,18 +646993,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -645743,57 +647872,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -645810,52 +647940,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -645930,7 +648059,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -646186,44 +648316,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -646256,31 +648385,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -646316,9 +648446,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -646375,27 +648507,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -646619,8 +648753,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -646685,18 +648819,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -647563,57 +649698,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -647630,52 +649766,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -647750,7 +649885,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -648006,44 +650142,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -648076,31 +650211,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -648136,9 +650272,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -648195,27 +650333,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -648439,8 +650579,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -648505,18 +650645,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -649383,57 +651524,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -649450,52 +651592,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -649570,7 +651711,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -649826,44 +651968,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -649896,31 +652037,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -649956,9 +652098,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -650015,27 +652159,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -650259,8 +652405,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -650325,18 +652471,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -651203,57 +653350,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -651270,52 +653418,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -651390,7 +653537,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -651646,44 +653794,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -651716,31 +653863,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -651776,9 +653924,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -651835,27 +653985,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -652079,8 +654231,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -652145,18 +654297,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -653023,57 +655176,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -653090,52 +655244,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -653210,7 +655363,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -653466,44 +655620,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -653536,31 +655689,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -653596,9 +655750,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -653655,27 +655811,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -653899,8 +656057,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -653965,18 +656123,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -654843,57 +657002,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -654910,52 +657070,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -655030,7 +657189,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -655286,44 +657446,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -655356,31 +657515,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -655416,9 +657576,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -655475,27 +657637,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -655719,8 +657883,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -655785,18 +657949,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -656663,57 +658828,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -656730,52 +658896,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -656850,7 +659015,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -657106,44 +659272,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -657176,31 +659341,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -657236,9 +659402,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -657295,27 +659463,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -657539,8 +659709,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -657605,18 +659775,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -658483,57 +660654,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -658550,52 +660722,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -658670,7 +660841,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -658926,44 +661098,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -658996,31 +661167,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -659056,9 +661228,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -659115,27 +661289,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -659359,8 +661535,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -659425,18 +661601,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -660303,57 +662480,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -660370,52 +662548,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -660490,7 +662667,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -660746,44 +662924,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -660816,31 +662993,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -660876,9 +663054,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -660935,27 +663115,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -661179,8 +663361,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -661245,18 +663427,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -662123,57 +664306,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -662190,52 +664374,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -662310,7 +664493,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -662566,44 +664750,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -662636,31 +664819,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -662696,9 +664880,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -662755,27 +664941,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -662999,8 +665187,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -663065,18 +665253,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -663943,57 +666132,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -664010,52 +666200,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -664130,7 +666319,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -664386,44 +666576,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -664456,31 +666645,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -664516,9 +666706,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -664575,27 +666767,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -664819,8 +667013,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -664885,18 +667079,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -665763,57 +667958,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -665830,52 +668026,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -665950,7 +668145,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -666206,44 +668402,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -666276,31 +668471,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -666336,9 +668532,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -666395,27 +668593,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -666639,8 +668839,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -666705,18 +668905,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -667583,57 +669784,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -667650,52 +669852,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -667770,7 +669971,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -668026,44 +670228,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -668096,31 +670297,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -668156,9 +670358,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -668215,27 +670419,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -668459,8 +670665,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -668525,18 +670731,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -669403,57 +671610,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -669470,52 +671678,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -669590,7 +671797,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -669846,44 +672054,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -669916,31 +672123,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -669976,9 +672184,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -670035,27 +672245,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -670279,8 +672491,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -670345,18 +672557,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -671223,57 +673436,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -671290,52 +673504,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -671410,7 +673623,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -671666,44 +673880,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -671736,31 +673949,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -671796,9 +674010,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -671855,27 +674071,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -672099,8 +674317,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -672165,18 +674383,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -673043,57 +675262,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -673110,52 +675330,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -673230,7 +675449,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -673486,44 +675706,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -673556,31 +675775,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -673616,9 +675836,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -673675,27 +675897,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -673919,8 +676143,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -673985,18 +676209,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -674863,57 +677088,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -674930,52 +677156,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -675050,7 +677275,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -675306,44 +677532,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -675376,31 +677601,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -675436,9 +677662,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -675495,27 +677723,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -675739,8 +677969,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -675805,18 +678035,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -676683,57 +678914,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -676750,52 +678982,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -676870,7 +679101,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -677126,44 +679358,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -677196,31 +679427,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -677256,9 +679488,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -677315,27 +679549,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -677559,8 +679795,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -677625,18 +679861,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -678503,57 +680740,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -678570,52 +680808,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -678690,7 +680927,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -678946,44 +681184,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -679016,31 +681253,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -679076,9 +681314,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -679135,27 +681375,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -679379,8 +681621,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -679445,18 +681687,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -680323,57 +682566,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -680390,52 +682634,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -680510,7 +682753,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -680766,44 +683010,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -680836,31 +683079,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -680896,9 +683140,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -680955,27 +683201,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -681199,8 +683447,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -681265,18 +683513,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -682143,57 +684392,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -682210,52 +684460,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -682330,7 +684579,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -682586,44 +684836,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -682656,31 +684905,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -682716,9 +684966,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -682775,27 +685027,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -683019,8 +685273,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -683085,18 +685339,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -683963,57 +686218,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -684030,52 +686286,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -684150,7 +686405,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -684406,44 +686662,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -684476,31 +686731,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -684536,9 +686792,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -684595,27 +686853,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -684839,8 +687099,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -684905,18 +687165,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -685783,57 +688044,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -685850,52 +688112,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -685970,7 +688231,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -686226,44 +688488,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -686296,31 +688557,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -686356,9 +688618,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -686415,27 +688679,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -686659,8 +688925,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -686725,18 +688991,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -687603,57 +689870,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -687670,52 +689938,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -687790,7 +690057,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
@@ -688046,44 +690314,43 @@
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml","21"
 "T1059.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_4104_hunting.yml","21"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","38"
-"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","38"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_raccine_scheduled_task_deletion.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","37"
+"T1562.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","37"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/sdelete_application_execution.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/recursive_delete_of_directory_in_batch_cmd.yml","5"
 "T1070.004","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml","5"
@@ -688116,31 +690383,32 @@
 "T1072","No","-","0"
 "T1035","No","-","0"
 "T1585.002","No","-","0"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","48"
-"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","48"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_edit_cron_table_parameter.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_application_execution.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_command_to_at_allow_config_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_file_created_in_systemd_directory.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_possible_cronjob_modification_with_editor.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_add_files_in_known_crontab_directories.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_at_allow_config_file_creation.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_started_or_enabled.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_service_restarted.yml","50"
+"T1053","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","50"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_in_develop.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_commit_changes_in_master.yml","3"
 "T1199","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml","3"
@@ -688176,9 +690444,11 @@
 "T1109","No","-","0"
 "T1069.003","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_iam_successful_group_deletion.yml","1"
 "T1563.001","No","-","0"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","3"
-"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","3"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_rclone.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_downloadfile.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___detect_rclone_command_line_usage.yml","5"
+"T1020","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml","5"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml","56"
 "T1087","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml","56"
@@ -688235,27 +690505,29 @@
 "T1569","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_sc_service_utility.yml","10"
 "T1148","No","-","0"
 "T1045","No","-","0"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","22"
-"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","22"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_remote_assistance_spawning_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wscript_or_cscript_suspicious_child_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_createremotethread_in_browser.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winhlp32_spawning_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/create_remote_thread_in_shell_application.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_create_remote_thread_to_a_process.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml","25"
+"T1055","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml","25"
 "T1090.002","No","-","0"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_chmod_utility.yml","3"
 "T1548.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/linux_setuid_using_setcap_utility.yml","3"
@@ -688479,8 +690751,8 @@
 "T1528","No","-","0"
 "T1589.003","No","-","0"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","16"
-"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","16"
+"T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","16"
 "T1218.011","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","16"
@@ -688545,18 +690817,19 @@
 "T1204","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/single_letter_process_on_endpoint.yml","24"
 "T1036.004","No","-","0"
 "T1156","No","-","0"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","12"
-"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","12"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_initiation_on_remote_endpoint.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_windows_task_scheduler_event_action_started.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_scheduling_job_on_remote_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_scheduled_task.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_within_public_path.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/possible_lateral_movement_powershell_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/scheduled_task_deleted_or_created_via_cmd.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/svchost_exe_lolbas_execution_process_spawn.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_used_for_forcing_a_reboot.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_schtasks_create_run_as_system.yml","13"
+"T1053.005","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_scheduled_task_from_public_directory.yml","13"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml","8"
 "T1558","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml","8"
@@ -689423,57 +691696,58 @@
 "T1542.001","No","-","0"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_dependabot_alert.yml","4"
 "T1195","Yes","https://github.com/splunk/security_content/blob/develop/cloud/github_pull_request_from_unknown_user.yml","4"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/rundll_loading_dll_by_ordinal.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","103"
-"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","103"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_rundll32_rename.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_icedid_rundll32_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll_loading_dll_by_ordinal.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_with_known_silent_switch_cmdline.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/regsvr32_silent_and_install_param_dll_loading.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_regsvr32_register_suspicious_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_control_rundll_hunt.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_spawn_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/cmlua_or_cmstplua_uac_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_child_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_with_no_command_line_arguments.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uac_bypass_with_colorui_com_object.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regasm_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_lockworkstation.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_process_creating_exe_dll_files.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_remote_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___syssetup.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/uninstall_app_using_msiexec.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvr32_application_control_bypass.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___setupapi.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_dllregisterserver.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_dnsquery.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_using_infotech_storage_handlers.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/office_product_spawn_cmd_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_mshta_spawn.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_credential_theft.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_spawning_a_process.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_uninstall_option.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_plugininit.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_with_no_command_line_arguments_with_network.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_inline_hta_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/control_loading_from_world_writable_directory.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_startw.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_html_help_url_in_command_line.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dotnet_binary_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/verclsid_clsid_execution.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_rundll32_application_control_bypass___advpack.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_installutil_in_non_standard_path.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_regsvcs_with_network_connection.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/detect_mshta_renamed.yml","104"
+"T1218","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wbemprox_com_object_execution.yml","104"
 "T1071.003","No","-","0"
 "T1543.004","No","-","0"
 "T1160","No","-","0"
@@ -689490,52 +691764,51 @@
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/remcos_client_registry_install_entry.yml","8"
 "T1112","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/rundll32_shimcache_flush.yml","8"
 "T1569.001","No","-","0"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/experimental/ssa___disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","94"
-"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","94"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/o365_bypass_mfa_via_trusted_ip.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_created_with_all_open_ports.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/cloud/aws_network_access_control_list_deleted.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_behavior_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_mpengine_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/firewall_allowed_program_enable.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_taskkill.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_firewall_with_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_controlpanel.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_defender_services.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/hide_user_account_from_sign_in_screen.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_windows_defender_exclusion_commands.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/add_or_set_windows_defender_exclusion.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_schedule_task.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/wmic_noninteractive_app_uninstallation.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_defender_exclusion_registry_entry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_spynet_reporting.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_registry_tool.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_disableantispyware_reg.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/attempt_to_stop_security_service.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_blockatfirstseen_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_amsi_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_show_hidden_files.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_folderoptions_windows_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_submit_samples_consent_feature.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_etw_through_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_file_and_printing_sharing_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_service_control_start_as_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_smartscreen_protection.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remove_windows_defender_directory.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_norun_windows_app.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_enhanced_notification.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/unload_sysmon_filter_driver.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_cmd_application.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_dism_remove_defender.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/processes_launching_netsh.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/powershell_disable_security_monitoring.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/etw_registry_disabled.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/process_kill_base_on_file_path.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_task_manager.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/allow_network_discovery_in_firewall.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disabling_systemrestore_in_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_defender_antivirus_registry.yml","92"
+"T1562","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_windows_app_hotkeys.yml","92"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/ssa___wevtutil_usage_to_disable_logs.yml","6"
 "T1070.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml","6"
@@ -689610,7 +691883,8 @@
 "T1071.004","Yes","https://github.com/splunk/security_content/blob/develop/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml","2"
 "T1553.001","No","-","0"
 "T1178","No","-","0"
-"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","1"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/loading_of_dynwrapx_module.yml","2"
+"T1055.001","Yes","https://github.com/splunk/security_content/blob/develop/endpoint/windows_rasautou_dll_execution.yml","2"
 "T1584.001","No","-","0"
 "T1080","No","-","0"
 "T1480","No","-","0"
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index 5b160993f2..4372832f39 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -79,8 +79,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -124,8 +124,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -173,8 +173,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -198,8 +198,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -410,7 +410,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -450,8 +450,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -1276,8 +1276,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -1298,8 +1298,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -1402,8 +1402,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -1626,8 +1626,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -1671,8 +1671,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -1720,8 +1720,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -1745,8 +1745,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -1957,7 +1957,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -1997,8 +1997,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -2823,8 +2823,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -2845,8 +2845,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -2949,8 +2949,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -3173,8 +3173,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -3218,8 +3218,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -3267,8 +3267,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -3292,8 +3292,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -3504,7 +3504,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -3544,8 +3544,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -4370,8 +4370,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -4392,8 +4392,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -4496,8 +4496,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -4720,8 +4720,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -4765,8 +4765,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -4814,8 +4814,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -4839,8 +4839,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -5051,7 +5051,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -5091,8 +5091,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -5917,8 +5917,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -5939,8 +5939,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -6043,8 +6043,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -6267,8 +6267,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -6312,8 +6312,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -6361,8 +6361,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -6386,8 +6386,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -6598,7 +6598,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -6638,8 +6638,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -7464,8 +7464,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -7486,8 +7486,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -7590,8 +7590,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -7814,8 +7814,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -7859,8 +7859,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -7908,8 +7908,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -7933,8 +7933,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -8145,7 +8145,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -8185,8 +8185,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -9011,8 +9011,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -9033,8 +9033,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -9137,8 +9137,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -9361,8 +9361,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -9406,8 +9406,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -9455,8 +9455,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -9480,8 +9480,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -9692,7 +9692,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -9732,8 +9732,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -10558,8 +10558,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -10580,8 +10580,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -10684,8 +10684,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -10908,8 +10908,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -10953,8 +10953,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -11002,8 +11002,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -11027,8 +11027,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -11239,7 +11239,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -11279,8 +11279,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -12105,8 +12105,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -12127,8 +12127,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -12231,8 +12231,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -12455,8 +12455,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -12500,8 +12500,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -12549,8 +12549,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -12574,8 +12574,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -12786,7 +12786,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -12826,8 +12826,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -13652,8 +13652,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -13674,8 +13674,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -13778,8 +13778,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -14002,8 +14002,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -14047,8 +14047,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -14096,8 +14096,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -14121,8 +14121,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -14333,7 +14333,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -14373,8 +14373,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -15199,8 +15199,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -15221,8 +15221,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -15325,8 +15325,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -15549,8 +15549,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -15594,8 +15594,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -15643,8 +15643,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -15668,8 +15668,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -15880,7 +15880,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -15920,8 +15920,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -16746,8 +16746,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -16768,8 +16768,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -16872,8 +16872,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -17096,8 +17096,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -17141,8 +17141,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -17190,8 +17190,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -17215,8 +17215,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -17427,7 +17427,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -17467,8 +17467,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -18293,8 +18293,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -18315,8 +18315,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -18419,8 +18419,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -18643,8 +18643,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -18688,8 +18688,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -18737,8 +18737,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -18762,8 +18762,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -18974,7 +18974,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -19014,8 +19014,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -19840,8 +19840,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -19862,8 +19862,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -19966,8 +19966,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -20190,8 +20190,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -20235,8 +20235,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -20284,8 +20284,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -20309,8 +20309,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -20521,7 +20521,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -20561,8 +20561,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -21387,8 +21387,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -21409,8 +21409,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -21513,8 +21513,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -21737,8 +21737,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -21782,8 +21782,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -21831,8 +21831,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -21856,8 +21856,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -22068,7 +22068,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -22108,8 +22108,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -22934,8 +22934,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -22956,8 +22956,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -23060,8 +23060,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -23284,8 +23284,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -23329,8 +23329,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -23378,8 +23378,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -23403,8 +23403,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -23615,7 +23615,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -23655,8 +23655,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -24481,8 +24481,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -24503,8 +24503,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -24607,8 +24607,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -24831,8 +24831,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -24876,8 +24876,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -24925,8 +24925,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -24950,8 +24950,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -25162,7 +25162,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -25202,8 +25202,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -26028,8 +26028,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -26050,8 +26050,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -26154,8 +26154,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -26378,8 +26378,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -26423,8 +26423,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -26472,8 +26472,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -26497,8 +26497,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -26709,7 +26709,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -26749,8 +26749,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -27575,8 +27575,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -27597,8 +27597,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -27701,8 +27701,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -27925,8 +27925,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -27970,8 +27970,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -28019,8 +28019,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -28044,8 +28044,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -28256,7 +28256,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -28296,8 +28296,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -29122,8 +29122,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -29144,8 +29144,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -29248,8 +29248,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -29472,8 +29472,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -29517,8 +29517,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -29566,8 +29566,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -29591,8 +29591,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -29803,7 +29803,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -29843,8 +29843,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -30669,8 +30669,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -30691,8 +30691,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -30795,8 +30795,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -31019,8 +31019,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -31064,8 +31064,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -31113,8 +31113,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -31138,8 +31138,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -31350,7 +31350,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -31390,8 +31390,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -32216,8 +32216,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -32238,8 +32238,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -32342,8 +32342,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -32566,8 +32566,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -32611,8 +32611,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -32660,8 +32660,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -32685,8 +32685,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -32897,7 +32897,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -32937,8 +32937,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -33763,8 +33763,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -33785,8 +33785,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -33889,8 +33889,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -34113,8 +34113,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -34158,8 +34158,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -34207,8 +34207,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -34232,8 +34232,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -34444,7 +34444,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -34484,8 +34484,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -35310,8 +35310,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -35332,8 +35332,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -35436,8 +35436,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -35660,8 +35660,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -35705,8 +35705,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -35754,8 +35754,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -35779,8 +35779,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -35991,7 +35991,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -36031,8 +36031,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -36857,8 +36857,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -36879,8 +36879,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -36983,8 +36983,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -37207,8 +37207,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -37252,8 +37252,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -37301,8 +37301,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -37326,8 +37326,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -37538,7 +37538,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -37578,8 +37578,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -38404,8 +38404,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -38426,8 +38426,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -38530,8 +38530,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -38754,8 +38754,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -38799,8 +38799,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -38848,8 +38848,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -38873,8 +38873,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -39085,7 +39085,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -39125,8 +39125,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -39951,8 +39951,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -39973,8 +39973,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -40077,8 +40077,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -40301,8 +40301,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -40346,8 +40346,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -40395,8 +40395,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -40420,8 +40420,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -40632,7 +40632,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -40672,8 +40672,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -41498,8 +41498,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -41520,8 +41520,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -41624,8 +41624,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -41848,8 +41848,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -41893,8 +41893,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -41942,8 +41942,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -41967,8 +41967,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -42179,7 +42179,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -42219,8 +42219,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -43045,8 +43045,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -43067,8 +43067,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -43171,8 +43171,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -43395,8 +43395,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -43440,8 +43440,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -43489,8 +43489,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -43514,8 +43514,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -43726,7 +43726,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -43766,8 +43766,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -44592,8 +44592,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -44614,8 +44614,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -44718,8 +44718,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -44942,8 +44942,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -44987,8 +44987,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -45036,8 +45036,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -45061,8 +45061,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -45273,7 +45273,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -45313,8 +45313,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -46139,8 +46139,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -46161,8 +46161,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -46265,8 +46265,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -46489,8 +46489,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -46534,8 +46534,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -46583,8 +46583,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -46608,8 +46608,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -46820,7 +46820,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -46860,8 +46860,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -47686,8 +47686,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -47708,8 +47708,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -47812,8 +47812,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -48036,8 +48036,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -48081,8 +48081,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -48130,8 +48130,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -48155,8 +48155,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -48367,7 +48367,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -48407,8 +48407,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -49233,8 +49233,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -49255,8 +49255,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -49359,8 +49359,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -49583,8 +49583,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -49628,8 +49628,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -49677,8 +49677,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -49702,8 +49702,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -49914,7 +49914,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -49954,8 +49954,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -50780,8 +50780,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -50802,8 +50802,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -50906,8 +50906,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -51130,8 +51130,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -51175,8 +51175,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -51224,8 +51224,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -51249,8 +51249,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -51461,7 +51461,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -51501,8 +51501,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -52327,8 +52327,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -52349,8 +52349,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -52453,8 +52453,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -52677,8 +52677,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -52722,8 +52722,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -52771,8 +52771,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -52796,8 +52796,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -53008,7 +53008,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -53048,8 +53048,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -53874,8 +53874,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -53896,8 +53896,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -54000,8 +54000,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -54224,8 +54224,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -54269,8 +54269,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -54318,8 +54318,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -54343,8 +54343,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -54555,7 +54555,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -54595,8 +54595,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -55421,8 +55421,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -55443,8 +55443,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -55547,8 +55547,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -55771,8 +55771,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -55816,8 +55816,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -55865,8 +55865,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -55890,8 +55890,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -56102,7 +56102,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -56142,8 +56142,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -56968,8 +56968,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -56990,8 +56990,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -57094,8 +57094,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -57318,8 +57318,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -57363,8 +57363,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -57412,8 +57412,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -57437,8 +57437,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -57649,7 +57649,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -57689,8 +57689,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -58515,8 +58515,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -58537,8 +58537,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -58641,8 +58641,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -58865,8 +58865,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -58910,8 +58910,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -58959,8 +58959,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -58984,8 +58984,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -59196,7 +59196,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -59236,8 +59236,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -60062,8 +60062,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -60084,8 +60084,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -60188,8 +60188,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -60412,8 +60412,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -60457,8 +60457,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -60506,8 +60506,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -60531,8 +60531,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -60743,7 +60743,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -60783,8 +60783,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -61609,8 +61609,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -61631,8 +61631,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -61735,8 +61735,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -61959,8 +61959,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -62004,8 +62004,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -62053,8 +62053,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -62078,8 +62078,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -62290,7 +62290,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -62330,8 +62330,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -63156,8 +63156,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -63178,8 +63178,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -63282,8 +63282,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -63506,8 +63506,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -63551,8 +63551,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -63600,8 +63600,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -63625,8 +63625,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -63837,7 +63837,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -63877,8 +63877,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -64703,8 +64703,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -64725,8 +64725,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -64829,8 +64829,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -65053,8 +65053,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -65098,8 +65098,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -65147,8 +65147,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -65172,8 +65172,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -65384,7 +65384,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -65424,8 +65424,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -66250,8 +66250,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -66272,8 +66272,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -66376,8 +66376,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -66600,8 +66600,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -66645,8 +66645,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -66694,8 +66694,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -66719,8 +66719,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -66931,7 +66931,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -66971,8 +66971,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -67797,8 +67797,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -67819,8 +67819,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -67923,8 +67923,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -68147,8 +68147,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -68192,8 +68192,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -68241,8 +68241,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -68266,8 +68266,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -68478,7 +68478,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -68518,8 +68518,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -69344,8 +69344,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -69366,8 +69366,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -69470,8 +69470,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -69694,8 +69694,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -69739,8 +69739,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -69788,8 +69788,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -69813,8 +69813,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -70025,7 +70025,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -70065,8 +70065,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -70891,8 +70891,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -70913,8 +70913,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -71017,8 +71017,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -71241,8 +71241,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -71286,8 +71286,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -71335,8 +71335,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -71360,8 +71360,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -71572,7 +71572,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -71612,8 +71612,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -72438,8 +72438,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -72460,8 +72460,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -72564,8 +72564,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -72788,8 +72788,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -72833,8 +72833,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -72882,8 +72882,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -72907,8 +72907,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -73119,7 +73119,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -73159,8 +73159,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -73985,8 +73985,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -74007,8 +74007,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -74111,8 +74111,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -74335,8 +74335,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -74380,8 +74380,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -74429,8 +74429,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -74454,8 +74454,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -74666,7 +74666,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -74706,8 +74706,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -75532,8 +75532,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -75554,8 +75554,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -75658,8 +75658,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -75882,8 +75882,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -75927,8 +75927,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -75976,8 +75976,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -76001,8 +76001,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -76213,7 +76213,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -76253,8 +76253,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -77079,8 +77079,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -77101,8 +77101,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -77205,8 +77205,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -77429,8 +77429,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -77474,8 +77474,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -77523,8 +77523,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -77548,8 +77548,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -77760,7 +77760,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -77800,8 +77800,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -78626,8 +78626,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -78648,8 +78648,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -78752,8 +78752,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -78976,8 +78976,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -79021,8 +79021,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -79070,8 +79070,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -79095,8 +79095,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -79307,7 +79307,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -79347,8 +79347,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -80173,8 +80173,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -80195,8 +80195,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -80299,8 +80299,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -80523,8 +80523,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -80568,8 +80568,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -80617,8 +80617,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -80642,8 +80642,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -80854,7 +80854,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -80894,8 +80894,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -81720,8 +81720,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -81742,8 +81742,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -81846,8 +81846,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -82070,8 +82070,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -82115,8 +82115,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -82164,8 +82164,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -82189,8 +82189,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -82401,7 +82401,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -82441,8 +82441,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -83267,8 +83267,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -83289,8 +83289,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -83393,8 +83393,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -83617,8 +83617,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -83662,8 +83662,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -83711,8 +83711,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -83736,8 +83736,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -83948,7 +83948,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -83988,8 +83988,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -84814,8 +84814,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -84836,8 +84836,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -84940,8 +84940,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -85164,8 +85164,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -85209,8 +85209,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -85258,8 +85258,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -85283,8 +85283,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -85495,7 +85495,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -85535,8 +85535,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -86361,8 +86361,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -86383,8 +86383,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -86487,8 +86487,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -86711,8 +86711,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -86756,8 +86756,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -86805,8 +86805,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -86830,8 +86830,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -87042,7 +87042,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -87082,8 +87082,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -87908,8 +87908,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -87930,8 +87930,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -88034,8 +88034,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -88258,8 +88258,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -88303,8 +88303,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -88352,8 +88352,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -88377,8 +88377,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -88589,7 +88589,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -88629,8 +88629,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -89455,8 +89455,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -89477,8 +89477,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -89581,8 +89581,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -89805,8 +89805,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -89850,8 +89850,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -89899,8 +89899,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -89924,8 +89924,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -90136,7 +90136,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -90176,8 +90176,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -91002,8 +91002,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -91024,8 +91024,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -91128,8 +91128,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -91352,8 +91352,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -91397,8 +91397,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -91446,8 +91446,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -91471,8 +91471,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -91683,7 +91683,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -91723,8 +91723,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -92549,8 +92549,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -92571,8 +92571,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -92675,8 +92675,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -92899,8 +92899,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -92944,8 +92944,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -92993,8 +92993,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -93018,8 +93018,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -93230,7 +93230,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -93270,8 +93270,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -94096,8 +94096,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -94118,8 +94118,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -94222,8 +94222,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -94446,8 +94446,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -94491,8 +94491,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -94540,8 +94540,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -94565,8 +94565,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -94777,7 +94777,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -94817,8 +94817,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -95643,8 +95643,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -95665,8 +95665,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -95769,8 +95769,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -95993,8 +95993,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -96038,8 +96038,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -96087,8 +96087,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -96112,8 +96112,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -96324,7 +96324,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -96364,8 +96364,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -97190,8 +97190,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -97212,8 +97212,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -97316,8 +97316,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -97540,8 +97540,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -97585,8 +97585,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -97634,8 +97634,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -97659,8 +97659,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -97871,7 +97871,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -97911,8 +97911,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -98737,8 +98737,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -98759,8 +98759,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -98863,8 +98863,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -99087,8 +99087,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -99132,8 +99132,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -99181,8 +99181,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -99206,8 +99206,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -99418,7 +99418,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -99458,8 +99458,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -100284,8 +100284,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -100306,8 +100306,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -100410,8 +100410,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -100634,8 +100634,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -100679,8 +100679,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -100728,8 +100728,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -100753,8 +100753,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -100965,7 +100965,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -101005,8 +101005,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -101831,8 +101831,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -101853,8 +101853,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -101957,8 +101957,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -102181,8 +102181,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -102226,8 +102226,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -102275,8 +102275,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -102300,8 +102300,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -102512,7 +102512,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -102552,8 +102552,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -103378,8 +103378,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -103400,8 +103400,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -103504,8 +103504,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -103728,8 +103728,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -103773,8 +103773,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -103822,8 +103822,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -103847,8 +103847,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -104059,7 +104059,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -104099,8 +104099,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -104925,8 +104925,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -104947,8 +104947,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -105051,8 +105051,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -105275,8 +105275,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -105320,8 +105320,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -105369,8 +105369,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -105394,8 +105394,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -105606,7 +105606,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -105646,8 +105646,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -106472,8 +106472,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -106494,8 +106494,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -106598,8 +106598,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -106822,8 +106822,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -106867,8 +106867,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -106916,8 +106916,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -106941,8 +106941,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -107153,7 +107153,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -107193,8 +107193,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -108019,8 +108019,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -108041,8 +108041,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -108145,8 +108145,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -108369,8 +108369,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -108414,8 +108414,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -108463,8 +108463,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -108488,8 +108488,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -108700,7 +108700,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -108740,8 +108740,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -109566,8 +109566,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -109588,8 +109588,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -109692,8 +109692,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -109916,8 +109916,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -109961,8 +109961,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -110010,8 +110010,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -110035,8 +110035,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -110247,7 +110247,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -110287,8 +110287,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -111113,8 +111113,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -111135,8 +111135,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -111239,8 +111239,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -111463,8 +111463,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -111508,8 +111508,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -111557,8 +111557,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -111582,8 +111582,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -111794,7 +111794,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -111834,8 +111834,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -112660,8 +112660,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -112682,8 +112682,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -112786,8 +112786,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -113010,8 +113010,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -113055,8 +113055,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -113104,8 +113104,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -113129,8 +113129,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -113341,7 +113341,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -113381,8 +113381,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -114207,8 +114207,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -114229,8 +114229,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -114333,8 +114333,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -114557,8 +114557,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -114602,8 +114602,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -114651,8 +114651,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -114676,8 +114676,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -114888,7 +114888,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -114928,8 +114928,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -115754,8 +115754,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -115776,8 +115776,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -115880,8 +115880,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -116104,8 +116104,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -116149,8 +116149,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -116198,8 +116198,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -116223,8 +116223,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -116435,7 +116435,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -116475,8 +116475,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -117301,8 +117301,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -117323,8 +117323,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -117427,8 +117427,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -117651,8 +117651,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -117696,8 +117696,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -117745,8 +117745,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -117770,8 +117770,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -117982,7 +117982,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -118022,8 +118022,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -118848,8 +118848,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -118870,8 +118870,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -118974,8 +118974,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -119198,8 +119198,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -119243,8 +119243,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -119292,8 +119292,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -119317,8 +119317,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -119529,7 +119529,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -119569,8 +119569,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -120395,8 +120395,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -120417,8 +120417,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -120521,8 +120521,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -120745,8 +120745,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -120790,8 +120790,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -120839,8 +120839,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -120864,8 +120864,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -121076,7 +121076,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -121116,8 +121116,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -121942,8 +121942,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -121964,8 +121964,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -122068,8 +122068,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -122292,8 +122292,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -122337,8 +122337,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -122386,8 +122386,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -122411,8 +122411,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -122623,7 +122623,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -122663,8 +122663,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -123489,8 +123489,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -123511,8 +123511,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -123615,8 +123615,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -123839,8 +123839,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -123884,8 +123884,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -123933,8 +123933,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -123958,8 +123958,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -124170,7 +124170,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -124210,8 +124210,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -125036,8 +125036,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -125058,8 +125058,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -125162,8 +125162,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -125386,8 +125386,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -125431,8 +125431,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -125480,8 +125480,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -125505,8 +125505,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -125717,7 +125717,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -125757,8 +125757,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -126583,8 +126583,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -126605,8 +126605,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -126709,8 +126709,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -126933,8 +126933,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -126978,8 +126978,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -127027,8 +127027,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -127052,8 +127052,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -127264,7 +127264,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -127304,8 +127304,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -128130,8 +128130,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -128152,8 +128152,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -128256,8 +128256,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -128480,8 +128480,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -128525,8 +128525,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -128574,8 +128574,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -128599,8 +128599,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -128811,7 +128811,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -128851,8 +128851,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -129677,8 +129677,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -129699,8 +129699,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -129803,8 +129803,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -130027,8 +130027,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -130072,8 +130072,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -130121,8 +130121,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -130146,8 +130146,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -130358,7 +130358,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -130398,8 +130398,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -131224,8 +131224,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -131246,8 +131246,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -131350,8 +131350,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -131574,8 +131574,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -131619,8 +131619,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -131668,8 +131668,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -131693,8 +131693,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -131905,7 +131905,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -131945,8 +131945,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -132771,8 +132771,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -132793,8 +132793,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -132897,8 +132897,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -133121,8 +133121,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -133166,8 +133166,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -133215,8 +133215,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -133240,8 +133240,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -133452,7 +133452,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -133492,8 +133492,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -134318,8 +134318,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -134340,8 +134340,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -134444,8 +134444,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -134668,8 +134668,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -134713,8 +134713,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -134762,8 +134762,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -134787,8 +134787,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -134999,7 +134999,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -135039,8 +135039,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -135865,8 +135865,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -135887,8 +135887,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -135991,8 +135991,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -136215,8 +136215,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -136260,8 +136260,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -136309,8 +136309,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -136334,8 +136334,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -136546,7 +136546,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -136586,8 +136586,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -137412,8 +137412,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -137434,8 +137434,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -137538,8 +137538,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -137762,8 +137762,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -137807,8 +137807,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -137856,8 +137856,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -137881,8 +137881,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -138093,7 +138093,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -138133,8 +138133,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -138959,8 +138959,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -138981,8 +138981,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -139085,8 +139085,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -139309,8 +139309,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -139354,8 +139354,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -139403,8 +139403,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -139428,8 +139428,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -139640,7 +139640,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -139680,8 +139680,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -140506,8 +140506,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -140528,8 +140528,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -140632,8 +140632,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -140856,8 +140856,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -140901,8 +140901,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -140950,8 +140950,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -140975,8 +140975,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -141187,7 +141187,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -141227,8 +141227,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -142053,8 +142053,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -142075,8 +142075,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -142179,8 +142179,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -142403,8 +142403,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -142448,8 +142448,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -142497,8 +142497,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -142522,8 +142522,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -142734,7 +142734,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -142774,8 +142774,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -143600,8 +143600,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -143622,8 +143622,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -143726,8 +143726,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -143950,8 +143950,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -143995,8 +143995,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -144044,8 +144044,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -144069,8 +144069,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -144281,7 +144281,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -144321,8 +144321,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -145147,8 +145147,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -145169,8 +145169,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -145273,8 +145273,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -145497,8 +145497,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -145542,8 +145542,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -145591,8 +145591,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -145616,8 +145616,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -145828,7 +145828,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -145868,8 +145868,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -146694,8 +146694,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -146716,8 +146716,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -146820,8 +146820,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -147044,8 +147044,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -147089,8 +147089,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -147138,8 +147138,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -147163,8 +147163,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -147375,7 +147375,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -147415,8 +147415,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -148241,8 +148241,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -148263,8 +148263,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -148367,8 +148367,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -148591,8 +148591,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -148636,8 +148636,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -148685,8 +148685,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -148710,8 +148710,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -148922,7 +148922,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -148962,8 +148962,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -149788,8 +149788,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -149810,8 +149810,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -149914,8 +149914,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -150138,8 +150138,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -150183,8 +150183,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -150232,8 +150232,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -150257,8 +150257,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -150469,7 +150469,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -150509,8 +150509,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -151335,8 +151335,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -151357,8 +151357,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -151461,8 +151461,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -151685,8 +151685,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -151730,8 +151730,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -151779,8 +151779,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -151804,8 +151804,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -152016,7 +152016,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -152056,8 +152056,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -152882,8 +152882,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -152904,8 +152904,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -153008,8 +153008,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -153232,8 +153232,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -153277,8 +153277,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -153326,8 +153326,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -153351,8 +153351,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -153563,7 +153563,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -153603,8 +153603,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -154429,8 +154429,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -154451,8 +154451,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -154555,8 +154555,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -154779,8 +154779,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -154824,8 +154824,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -154873,8 +154873,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -154898,8 +154898,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -155110,7 +155110,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -155150,8 +155150,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -155976,8 +155976,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -155998,8 +155998,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -156102,8 +156102,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -156326,8 +156326,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -156371,8 +156371,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -156420,8 +156420,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -156445,8 +156445,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -156657,7 +156657,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -156697,8 +156697,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -157523,8 +157523,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -157545,8 +157545,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -157649,8 +157649,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -157873,8 +157873,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -157918,8 +157918,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -157967,8 +157967,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -157992,8 +157992,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -158204,7 +158204,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -158244,8 +158244,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -159070,8 +159070,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -159092,8 +159092,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -159196,8 +159196,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -159420,8 +159420,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -159465,8 +159465,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -159514,8 +159514,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -159539,8 +159539,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -159751,7 +159751,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -159791,8 +159791,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -160617,8 +160617,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -160639,8 +160639,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -160743,8 +160743,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -160967,8 +160967,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -161012,8 +161012,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -161061,8 +161061,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -161086,8 +161086,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -161298,7 +161298,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -161338,8 +161338,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -162164,8 +162164,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -162186,8 +162186,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -162290,8 +162290,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -162514,8 +162514,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -162559,8 +162559,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -162608,8 +162608,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -162633,8 +162633,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -162845,7 +162845,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -162885,8 +162885,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -163711,8 +163711,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -163733,8 +163733,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -163837,8 +163837,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -164061,8 +164061,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -164106,8 +164106,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -164155,8 +164155,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -164180,8 +164180,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -164392,7 +164392,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -164432,8 +164432,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -165258,8 +165258,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -165280,8 +165280,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -165384,8 +165384,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -165608,8 +165608,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -165653,8 +165653,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -165702,8 +165702,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -165727,8 +165727,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -165939,7 +165939,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -165979,8 +165979,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -166805,8 +166805,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -166827,8 +166827,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -166931,8 +166931,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -167155,8 +167155,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -167200,8 +167200,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -167249,8 +167249,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -167274,8 +167274,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -167486,7 +167486,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -167526,8 +167526,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -168352,8 +168352,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -168374,8 +168374,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -168478,8 +168478,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -168702,8 +168702,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -168747,8 +168747,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -168796,8 +168796,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -168821,8 +168821,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -169033,7 +169033,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -169073,8 +169073,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -169899,8 +169899,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -169921,8 +169921,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -170025,8 +170025,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -170249,8 +170249,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -170294,8 +170294,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -170343,8 +170343,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -170368,8 +170368,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -170580,7 +170580,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -170620,8 +170620,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -171446,8 +171446,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -171468,8 +171468,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -171572,8 +171572,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -171796,8 +171796,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -171841,8 +171841,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -171890,8 +171890,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -171915,8 +171915,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -172127,7 +172127,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -172167,8 +172167,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -172993,8 +172993,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -173015,8 +173015,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -173119,8 +173119,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -173343,8 +173343,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -173388,8 +173388,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -173437,8 +173437,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -173462,8 +173462,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -173674,7 +173674,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -173714,8 +173714,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -174540,8 +174540,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -174562,8 +174562,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -174666,8 +174666,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -174890,8 +174890,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -174935,8 +174935,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -174984,8 +174984,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -175009,8 +175009,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -175221,7 +175221,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -175261,8 +175261,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -176087,8 +176087,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -176109,8 +176109,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -176213,8 +176213,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -176437,8 +176437,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -176482,8 +176482,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -176531,8 +176531,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -176556,8 +176556,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -176768,7 +176768,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -176808,8 +176808,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -177634,8 +177634,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -177656,8 +177656,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -177760,8 +177760,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -177984,8 +177984,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -178029,8 +178029,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -178078,8 +178078,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -178103,8 +178103,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -178315,7 +178315,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -178355,8 +178355,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -179181,8 +179181,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -179203,8 +179203,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -179307,8 +179307,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -179531,8 +179531,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -179576,8 +179576,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -179625,8 +179625,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -179650,8 +179650,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -179862,7 +179862,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -179902,8 +179902,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -180728,8 +180728,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -180750,8 +180750,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -180854,8 +180854,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -181078,8 +181078,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -181123,8 +181123,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -181172,8 +181172,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -181197,8 +181197,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -181409,7 +181409,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -181449,8 +181449,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -182275,8 +182275,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -182297,8 +182297,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -182401,8 +182401,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -182625,8 +182625,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -182670,8 +182670,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -182719,8 +182719,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -182744,8 +182744,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -182956,7 +182956,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -182996,8 +182996,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -183822,8 +183822,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -183844,8 +183844,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -183948,8 +183948,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -184172,8 +184172,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -184217,8 +184217,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -184266,8 +184266,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -184291,8 +184291,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -184503,7 +184503,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -184543,8 +184543,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -185369,8 +185369,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -185391,8 +185391,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -185495,8 +185495,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -185719,8 +185719,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -185764,8 +185764,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -185813,8 +185813,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -185838,8 +185838,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -186050,7 +186050,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -186090,8 +186090,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -186916,8 +186916,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -186938,8 +186938,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -187042,8 +187042,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -187266,8 +187266,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -187311,8 +187311,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -187360,8 +187360,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -187385,8 +187385,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -187597,7 +187597,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -187637,8 +187637,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -188463,8 +188463,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -188485,8 +188485,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -188589,8 +188589,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -188813,8 +188813,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -188858,8 +188858,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -188907,8 +188907,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -188932,8 +188932,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -189144,7 +189144,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -189184,8 +189184,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -190010,8 +190010,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -190032,8 +190032,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -190136,8 +190136,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -190360,8 +190360,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -190405,8 +190405,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -190454,8 +190454,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -190479,8 +190479,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -190691,7 +190691,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -190731,8 +190731,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -191557,8 +191557,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -191579,8 +191579,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -191683,8 +191683,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -191907,8 +191907,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -191952,8 +191952,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -192001,8 +192001,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -192026,8 +192026,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -192238,7 +192238,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -192278,8 +192278,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -193104,8 +193104,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -193126,8 +193126,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -193230,8 +193230,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -193454,8 +193454,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -193499,8 +193499,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -193548,8 +193548,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -193573,8 +193573,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -193785,7 +193785,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -193825,8 +193825,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -194651,8 +194651,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -194673,8 +194673,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -194777,8 +194777,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -195001,8 +195001,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -195046,8 +195046,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -195095,8 +195095,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -195120,8 +195120,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -195332,7 +195332,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -195372,8 +195372,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -196198,8 +196198,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -196220,8 +196220,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -196324,8 +196324,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -196548,8 +196548,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -196593,8 +196593,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -196642,8 +196642,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -196667,8 +196667,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -196879,7 +196879,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -196919,8 +196919,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -197745,8 +197745,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -197767,8 +197767,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -197871,8 +197871,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -198095,8 +198095,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -198140,8 +198140,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -198189,8 +198189,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -198214,8 +198214,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -198426,7 +198426,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -198466,8 +198466,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -199292,8 +199292,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -199314,8 +199314,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -199418,8 +199418,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -199642,8 +199642,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -199687,8 +199687,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -199736,8 +199736,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -199761,8 +199761,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -199973,7 +199973,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -200013,8 +200013,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -200839,8 +200839,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -200861,8 +200861,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -200965,8 +200965,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -201189,8 +201189,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -201234,8 +201234,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -201283,8 +201283,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -201308,8 +201308,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -201520,7 +201520,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -201560,8 +201560,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -202386,8 +202386,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -202408,8 +202408,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -202512,8 +202512,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -202736,8 +202736,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -202781,8 +202781,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -202830,8 +202830,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -202855,8 +202855,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -203067,7 +203067,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -203107,8 +203107,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -203933,8 +203933,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -203955,8 +203955,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -204059,8 +204059,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -204283,8 +204283,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -204328,8 +204328,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -204377,8 +204377,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -204402,8 +204402,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -204614,7 +204614,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -204654,8 +204654,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -205480,8 +205480,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -205502,8 +205502,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -205606,8 +205606,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -205830,8 +205830,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -205875,8 +205875,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -205924,8 +205924,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -205949,8 +205949,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -206161,7 +206161,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -206201,8 +206201,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -207027,8 +207027,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -207049,8 +207049,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -207153,8 +207153,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -207377,8 +207377,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -207422,8 +207422,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -207471,8 +207471,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -207496,8 +207496,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -207708,7 +207708,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -207748,8 +207748,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -208574,8 +208574,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -208596,8 +208596,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -208700,8 +208700,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -208924,8 +208924,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -208969,8 +208969,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -209018,8 +209018,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -209043,8 +209043,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -209255,7 +209255,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -209295,8 +209295,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -210121,8 +210121,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -210143,8 +210143,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -210247,8 +210247,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -210471,8 +210471,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -210516,8 +210516,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -210565,8 +210565,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -210590,8 +210590,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -210802,7 +210802,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -210842,8 +210842,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -211668,8 +211668,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -211690,8 +211690,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -211794,8 +211794,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -212018,8 +212018,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -212063,8 +212063,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -212112,8 +212112,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -212137,8 +212137,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -212349,7 +212349,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -212389,8 +212389,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -213215,8 +213215,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -213237,8 +213237,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -213341,8 +213341,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -213565,8 +213565,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -213610,8 +213610,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -213659,8 +213659,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -213684,8 +213684,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -213896,7 +213896,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -213936,8 +213936,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -214762,8 +214762,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -214784,8 +214784,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -214888,8 +214888,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -215112,8 +215112,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -215157,8 +215157,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -215206,8 +215206,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -215231,8 +215231,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -215443,7 +215443,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -215483,8 +215483,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -216309,8 +216309,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -216331,8 +216331,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -216435,8 +216435,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -216659,8 +216659,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -216704,8 +216704,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -216753,8 +216753,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -216778,8 +216778,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -216990,7 +216990,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -217030,8 +217030,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -217856,8 +217856,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -217878,8 +217878,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -217982,8 +217982,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -218206,8 +218206,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -218251,8 +218251,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -218300,8 +218300,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -218325,8 +218325,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -218537,7 +218537,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -218577,8 +218577,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -219403,8 +219403,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -219425,8 +219425,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -219529,8 +219529,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -219753,8 +219753,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -219798,8 +219798,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -219847,8 +219847,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -219872,8 +219872,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -220084,7 +220084,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -220124,8 +220124,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -220950,8 +220950,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -220972,8 +220972,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -221076,8 +221076,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -221300,8 +221300,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -221345,8 +221345,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -221394,8 +221394,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -221419,8 +221419,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -221631,7 +221631,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -221671,8 +221671,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -222497,8 +222497,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -222519,8 +222519,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -222623,8 +222623,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -222847,8 +222847,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -222892,8 +222892,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -222941,8 +222941,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -222966,8 +222966,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -223178,7 +223178,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -223218,8 +223218,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -224044,8 +224044,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -224066,8 +224066,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -224170,8 +224170,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -224394,8 +224394,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -224439,8 +224439,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -224488,8 +224488,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -224513,8 +224513,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -224725,7 +224725,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -224765,8 +224765,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -225591,8 +225591,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -225613,8 +225613,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -225717,8 +225717,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -225941,8 +225941,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -225986,8 +225986,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -226035,8 +226035,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -226060,8 +226060,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -226272,7 +226272,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -226312,8 +226312,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -227138,8 +227138,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -227160,8 +227160,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -227264,8 +227264,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -227488,8 +227488,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -227533,8 +227533,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -227582,8 +227582,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -227607,8 +227607,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -227819,7 +227819,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -227859,8 +227859,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -228685,8 +228685,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -228707,8 +228707,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -228811,8 +228811,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -229035,8 +229035,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -229080,8 +229080,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -229129,8 +229129,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -229154,8 +229154,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -229366,7 +229366,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -229406,8 +229406,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -230232,8 +230232,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -230254,8 +230254,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -230358,8 +230358,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -230582,8 +230582,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -230627,8 +230627,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -230676,8 +230676,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -230701,8 +230701,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -230913,7 +230913,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -230953,8 +230953,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -231779,8 +231779,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -231801,8 +231801,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -231905,8 +231905,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -232129,8 +232129,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -232174,8 +232174,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -232223,8 +232223,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -232248,8 +232248,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -232460,7 +232460,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -232500,8 +232500,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -233326,8 +233326,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -233348,8 +233348,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -233452,8 +233452,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -233676,8 +233676,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -233721,8 +233721,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -233770,8 +233770,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -233795,8 +233795,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -234007,7 +234007,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -234047,8 +234047,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -234873,8 +234873,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -234895,8 +234895,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -234999,8 +234999,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -235223,8 +235223,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -235268,8 +235268,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -235317,8 +235317,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -235342,8 +235342,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -235554,7 +235554,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -235594,8 +235594,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -236420,8 +236420,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -236442,8 +236442,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -236546,8 +236546,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -236770,8 +236770,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -236815,8 +236815,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -236864,8 +236864,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -236889,8 +236889,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -237101,7 +237101,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -237141,8 +237141,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -237967,8 +237967,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -237989,8 +237989,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -238093,8 +238093,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -238317,8 +238317,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -238362,8 +238362,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -238411,8 +238411,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -238436,8 +238436,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -238648,7 +238648,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -238688,8 +238688,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -239514,8 +239514,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -239536,8 +239536,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -239640,8 +239640,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -239864,8 +239864,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -239909,8 +239909,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -239958,8 +239958,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -239983,8 +239983,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -240195,7 +240195,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -240235,8 +240235,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -241061,8 +241061,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -241083,8 +241083,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -241187,8 +241187,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -241411,8 +241411,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -241456,8 +241456,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -241505,8 +241505,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -241530,8 +241530,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -241742,7 +241742,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -241782,8 +241782,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -242608,8 +242608,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -242630,8 +242630,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -242734,8 +242734,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -242958,8 +242958,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -243003,8 +243003,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -243052,8 +243052,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -243077,8 +243077,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -243289,7 +243289,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -243329,8 +243329,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -244155,8 +244155,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -244177,8 +244177,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -244281,8 +244281,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -244505,8 +244505,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -244550,8 +244550,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -244599,8 +244599,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -244624,8 +244624,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -244836,7 +244836,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -244876,8 +244876,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -245702,8 +245702,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -245724,8 +245724,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -245828,8 +245828,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -246052,8 +246052,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -246097,8 +246097,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -246146,8 +246146,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -246171,8 +246171,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -246383,7 +246383,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -246423,8 +246423,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -247249,8 +247249,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -247271,8 +247271,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -247375,8 +247375,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -247599,8 +247599,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -247644,8 +247644,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -247693,8 +247693,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -247718,8 +247718,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -247930,7 +247930,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -247970,8 +247970,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -248796,8 +248796,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -248818,8 +248818,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -248922,8 +248922,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -249146,8 +249146,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -249191,8 +249191,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -249240,8 +249240,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -249265,8 +249265,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -249477,7 +249477,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -249517,8 +249517,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -250343,8 +250343,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -250365,8 +250365,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -250469,8 +250469,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -250693,8 +250693,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -250738,8 +250738,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -250787,8 +250787,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -250812,8 +250812,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -251024,7 +251024,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -251064,8 +251064,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -251890,8 +251890,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -251912,8 +251912,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -252016,8 +252016,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -252240,8 +252240,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -252285,8 +252285,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -252334,8 +252334,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -252359,8 +252359,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -252571,7 +252571,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -252611,8 +252611,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -253437,8 +253437,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -253459,8 +253459,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -253563,8 +253563,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -253787,8 +253787,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -253832,8 +253832,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -253881,8 +253881,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -253906,8 +253906,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -254118,7 +254118,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -254158,8 +254158,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -254984,8 +254984,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -255006,8 +255006,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -255110,8 +255110,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -255334,8 +255334,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -255379,8 +255379,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -255428,8 +255428,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -255453,8 +255453,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -255665,7 +255665,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -255705,8 +255705,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -256531,8 +256531,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -256553,8 +256553,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -256657,8 +256657,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -256881,8 +256881,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -256926,8 +256926,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -256975,8 +256975,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -257000,8 +257000,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -257212,7 +257212,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -257252,8 +257252,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -258078,8 +258078,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -258100,8 +258100,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -258204,8 +258204,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -258428,8 +258428,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -258473,8 +258473,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -258522,8 +258522,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -258547,8 +258547,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -258759,7 +258759,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -258799,8 +258799,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -259625,8 +259625,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -259647,8 +259647,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -259751,8 +259751,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -259975,8 +259975,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -260020,8 +260020,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -260069,8 +260069,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -260094,8 +260094,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -260306,7 +260306,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -260346,8 +260346,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -261172,8 +261172,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -261194,8 +261194,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -261298,8 +261298,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -261522,8 +261522,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -261567,8 +261567,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -261616,8 +261616,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -261641,8 +261641,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -261853,7 +261853,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -261893,8 +261893,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -262719,8 +262719,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -262741,8 +262741,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -262845,8 +262845,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -263069,8 +263069,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -263114,8 +263114,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -263163,8 +263163,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -263188,8 +263188,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -263400,7 +263400,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -263440,8 +263440,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -264266,8 +264266,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -264288,8 +264288,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -264392,8 +264392,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -264616,8 +264616,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -264661,8 +264661,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -264710,8 +264710,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -264735,8 +264735,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -264947,7 +264947,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -264987,8 +264987,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -265813,8 +265813,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -265835,8 +265835,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -265939,8 +265939,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -266163,8 +266163,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -266208,8 +266208,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -266257,8 +266257,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -266282,8 +266282,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -266494,7 +266494,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -266534,8 +266534,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -267360,8 +267360,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -267382,8 +267382,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -267486,8 +267486,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -267710,8 +267710,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -267755,8 +267755,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -267804,8 +267804,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -267829,8 +267829,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -268041,7 +268041,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -268081,8 +268081,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -268907,8 +268907,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -268929,8 +268929,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -269033,8 +269033,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -269257,8 +269257,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -269302,8 +269302,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -269351,8 +269351,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -269376,8 +269376,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -269588,7 +269588,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -269628,8 +269628,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -270454,8 +270454,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -270476,8 +270476,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -270580,8 +270580,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -270804,8 +270804,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -270849,8 +270849,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -270898,8 +270898,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -270923,8 +270923,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -271135,7 +271135,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -271175,8 +271175,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -272001,8 +272001,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -272023,8 +272023,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -272127,8 +272127,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -272351,8 +272351,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -272396,8 +272396,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -272445,8 +272445,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -272470,8 +272470,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -272682,7 +272682,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -272722,8 +272722,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -273548,8 +273548,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -273570,8 +273570,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -273674,8 +273674,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -273898,8 +273898,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -273943,8 +273943,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -273992,8 +273992,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -274017,8 +274017,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -274229,7 +274229,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -274269,8 +274269,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -275095,8 +275095,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -275117,8 +275117,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -275221,8 +275221,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -275445,8 +275445,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -275490,8 +275490,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -275539,8 +275539,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -275564,8 +275564,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -275776,7 +275776,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -275816,8 +275816,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -276642,8 +276642,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -276664,8 +276664,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -276768,8 +276768,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -276992,8 +276992,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -277037,8 +277037,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -277086,8 +277086,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -277111,8 +277111,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -277323,7 +277323,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -277363,8 +277363,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -278189,8 +278189,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -278211,8 +278211,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -278315,8 +278315,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -278539,8 +278539,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -278584,8 +278584,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -278633,8 +278633,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -278658,8 +278658,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -278870,7 +278870,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -278910,8 +278910,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -279736,8 +279736,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -279758,8 +279758,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -279862,8 +279862,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -280086,8 +280086,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -280131,8 +280131,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -280180,8 +280180,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -280205,8 +280205,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -280417,7 +280417,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -280457,8 +280457,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -281283,8 +281283,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -281305,8 +281305,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -281409,8 +281409,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -281633,8 +281633,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -281678,8 +281678,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -281727,8 +281727,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -281752,8 +281752,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -281964,7 +281964,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -282004,8 +282004,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -282830,8 +282830,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -282852,8 +282852,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -282956,8 +282956,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -283180,8 +283180,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -283225,8 +283225,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -283274,8 +283274,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -283299,8 +283299,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -283511,7 +283511,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -283551,8 +283551,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -284377,8 +284377,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -284399,8 +284399,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -284503,8 +284503,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -284727,8 +284727,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -284772,8 +284772,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -284821,8 +284821,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -284846,8 +284846,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -285058,7 +285058,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -285098,8 +285098,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -285924,8 +285924,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -285946,8 +285946,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -286050,8 +286050,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -286274,8 +286274,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -286319,8 +286319,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -286368,8 +286368,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -286393,8 +286393,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -286605,7 +286605,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -286645,8 +286645,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -287471,8 +287471,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -287493,8 +287493,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -287597,8 +287597,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -287821,8 +287821,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -287866,8 +287866,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -287915,8 +287915,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -287940,8 +287940,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -288152,7 +288152,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -288192,8 +288192,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -289018,8 +289018,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -289040,8 +289040,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -289144,8 +289144,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -289368,8 +289368,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -289413,8 +289413,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -289462,8 +289462,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -289487,8 +289487,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -289699,7 +289699,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -289739,8 +289739,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -290565,8 +290565,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -290587,8 +290587,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -290691,8 +290691,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -290915,8 +290915,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -290960,8 +290960,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -291009,8 +291009,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -291034,8 +291034,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -291246,7 +291246,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -291286,8 +291286,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -292112,8 +292112,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -292134,8 +292134,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -292238,8 +292238,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -292462,8 +292462,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -292507,8 +292507,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -292556,8 +292556,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -292581,8 +292581,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -292793,7 +292793,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -292833,8 +292833,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -293659,8 +293659,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -293681,8 +293681,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -293785,8 +293785,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -294009,8 +294009,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -294054,8 +294054,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -294103,8 +294103,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -294128,8 +294128,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -294340,7 +294340,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -294380,8 +294380,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -295206,8 +295206,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -295228,8 +295228,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -295332,8 +295332,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -295556,8 +295556,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -295601,8 +295601,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -295650,8 +295650,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -295675,8 +295675,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -295887,7 +295887,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -295927,8 +295927,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -296753,8 +296753,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -296775,8 +296775,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -296879,8 +296879,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -297103,8 +297103,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -297148,8 +297148,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -297197,8 +297197,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -297222,8 +297222,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -297434,7 +297434,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -297474,8 +297474,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -298300,8 +298300,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -298322,8 +298322,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -298426,8 +298426,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -298650,8 +298650,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -298695,8 +298695,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -298744,8 +298744,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -298769,8 +298769,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -298981,7 +298981,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -299021,8 +299021,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -299847,8 +299847,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -299869,8 +299869,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -299973,8 +299973,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -300197,8 +300197,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -300242,8 +300242,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -300291,8 +300291,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -300316,8 +300316,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -300528,7 +300528,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -300568,8 +300568,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -301394,8 +301394,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -301416,8 +301416,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -301520,8 +301520,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -301744,8 +301744,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -301789,8 +301789,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -301838,8 +301838,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -301863,8 +301863,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -302075,7 +302075,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -302115,8 +302115,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -302941,8 +302941,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -302963,8 +302963,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -303067,8 +303067,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -303291,8 +303291,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -303336,8 +303336,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -303385,8 +303385,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -303410,8 +303410,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -303622,7 +303622,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -303662,8 +303662,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -304488,8 +304488,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -304510,8 +304510,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -304614,8 +304614,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -304838,8 +304838,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -304883,8 +304883,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -304932,8 +304932,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -304957,8 +304957,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -305169,7 +305169,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -305209,8 +305209,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -306035,8 +306035,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -306057,8 +306057,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -306161,8 +306161,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -306385,8 +306385,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -306430,8 +306430,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -306479,8 +306479,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -306504,8 +306504,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -306716,7 +306716,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -306756,8 +306756,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -307582,8 +307582,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -307604,8 +307604,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -307708,8 +307708,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -307932,8 +307932,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -307977,8 +307977,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -308026,8 +308026,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -308051,8 +308051,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -308263,7 +308263,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -308303,8 +308303,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -309129,8 +309129,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -309151,8 +309151,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -309255,8 +309255,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -309479,8 +309479,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -309524,8 +309524,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -309573,8 +309573,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -309598,8 +309598,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -309810,7 +309810,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -309850,8 +309850,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -310676,8 +310676,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -310698,8 +310698,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -310802,8 +310802,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -311026,8 +311026,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -311071,8 +311071,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -311120,8 +311120,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -311145,8 +311145,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -311357,7 +311357,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -311397,8 +311397,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -312223,8 +312223,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -312245,8 +312245,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -312349,8 +312349,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -312573,8 +312573,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -312618,8 +312618,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -312667,8 +312667,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -312692,8 +312692,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -312904,7 +312904,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -312944,8 +312944,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -313770,8 +313770,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -313792,8 +313792,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -313896,8 +313896,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -314120,8 +314120,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -314165,8 +314165,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -314214,8 +314214,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -314239,8 +314239,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -314451,7 +314451,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -314491,8 +314491,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -315317,8 +315317,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -315339,8 +315339,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -315443,8 +315443,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -315667,8 +315667,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -315712,8 +315712,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -315761,8 +315761,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -315786,8 +315786,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -315998,7 +315998,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -316038,8 +316038,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -316864,8 +316864,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -316886,8 +316886,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -316990,8 +316990,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -317214,8 +317214,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -317259,8 +317259,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -317308,8 +317308,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -317333,8 +317333,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -317545,7 +317545,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -317585,8 +317585,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -318411,8 +318411,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -318433,8 +318433,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -318537,8 +318537,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -318761,8 +318761,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -318806,8 +318806,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -318855,8 +318855,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -318880,8 +318880,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -319092,7 +319092,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -319132,8 +319132,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -319958,8 +319958,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -319980,8 +319980,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -320084,8 +320084,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -320308,8 +320308,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -320353,8 +320353,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -320402,8 +320402,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -320427,8 +320427,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -320639,7 +320639,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -320679,8 +320679,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -321505,8 +321505,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -321527,8 +321527,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -321631,8 +321631,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -321855,8 +321855,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -321900,8 +321900,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -321949,8 +321949,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -321974,8 +321974,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -322186,7 +322186,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -322226,8 +322226,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -323052,8 +323052,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -323074,8 +323074,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -323178,8 +323178,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -323402,8 +323402,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -323447,8 +323447,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -323496,8 +323496,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -323521,8 +323521,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -323733,7 +323733,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -323773,8 +323773,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -324599,8 +324599,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -324621,8 +324621,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -324725,8 +324725,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -324949,8 +324949,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -324994,8 +324994,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -325043,8 +325043,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -325068,8 +325068,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -325280,7 +325280,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -325320,8 +325320,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -326146,8 +326146,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -326168,8 +326168,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -326272,8 +326272,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -326496,8 +326496,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -326541,8 +326541,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -326590,8 +326590,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -326615,8 +326615,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -326827,7 +326827,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -326867,8 +326867,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -327693,8 +327693,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -327715,8 +327715,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -327819,8 +327819,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -328043,8 +328043,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -328088,8 +328088,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -328137,8 +328137,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -328162,8 +328162,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -328374,7 +328374,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -328414,8 +328414,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -329240,8 +329240,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -329262,8 +329262,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -329366,8 +329366,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -329590,8 +329590,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -329635,8 +329635,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -329684,8 +329684,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -329709,8 +329709,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -329921,7 +329921,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -329961,8 +329961,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -330787,8 +330787,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -330809,8 +330809,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -330913,8 +330913,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -331137,8 +331137,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -331182,8 +331182,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -331231,8 +331231,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -331256,8 +331256,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -331468,7 +331468,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -331508,8 +331508,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -332334,8 +332334,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -332356,8 +332356,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -332460,8 +332460,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -332684,8 +332684,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -332729,8 +332729,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -332778,8 +332778,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -332803,8 +332803,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -333015,7 +333015,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -333055,8 +333055,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -333881,8 +333881,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -333903,8 +333903,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -334007,8 +334007,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -334231,8 +334231,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -334276,8 +334276,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -334325,8 +334325,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -334350,8 +334350,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -334562,7 +334562,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -334602,8 +334602,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -335428,8 +335428,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -335450,8 +335450,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -335554,8 +335554,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -335778,8 +335778,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -335823,8 +335823,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -335872,8 +335872,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -335897,8 +335897,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -336109,7 +336109,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -336149,8 +336149,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -336975,8 +336975,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -336997,8 +336997,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -337101,8 +337101,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -337325,8 +337325,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -337370,8 +337370,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -337419,8 +337419,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -337444,8 +337444,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -337656,7 +337656,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -337696,8 +337696,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -338522,8 +338522,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -338544,8 +338544,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -338648,8 +338648,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -338872,8 +338872,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -338917,8 +338917,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -338966,8 +338966,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -338991,8 +338991,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -339203,7 +339203,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -339243,8 +339243,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -340069,8 +340069,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -340091,8 +340091,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -340195,8 +340195,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -340419,8 +340419,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -340464,8 +340464,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -340513,8 +340513,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -340538,8 +340538,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -340750,7 +340750,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -340790,8 +340790,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -341616,8 +341616,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -341638,8 +341638,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -341742,8 +341742,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -341966,8 +341966,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -342011,8 +342011,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -342060,8 +342060,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -342085,8 +342085,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -342297,7 +342297,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -342337,8 +342337,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -343163,8 +343163,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -343185,8 +343185,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -343289,8 +343289,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -343513,8 +343513,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -343558,8 +343558,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -343607,8 +343607,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -343632,8 +343632,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -343844,7 +343844,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -343884,8 +343884,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -344710,8 +344710,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -344732,8 +344732,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -344836,8 +344836,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -345060,8 +345060,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -345105,8 +345105,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -345154,8 +345154,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -345179,8 +345179,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -345391,7 +345391,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -345431,8 +345431,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -346257,8 +346257,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -346279,8 +346279,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -346383,8 +346383,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -346607,8 +346607,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -346652,8 +346652,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -346701,8 +346701,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -346726,8 +346726,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -346938,7 +346938,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -346978,8 +346978,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -347804,8 +347804,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -347826,8 +347826,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -347930,8 +347930,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -348154,8 +348154,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -348199,8 +348199,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -348248,8 +348248,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -348273,8 +348273,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -348485,7 +348485,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -348525,8 +348525,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -349351,8 +349351,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -349373,8 +349373,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -349477,8 +349477,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -349701,8 +349701,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -349746,8 +349746,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -349795,8 +349795,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -349820,8 +349820,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -350032,7 +350032,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -350072,8 +350072,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -350898,8 +350898,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -350920,8 +350920,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -351024,8 +351024,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -351248,8 +351248,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -351293,8 +351293,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -351342,8 +351342,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -351367,8 +351367,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -351579,7 +351579,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -351619,8 +351619,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -352445,8 +352445,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -352467,8 +352467,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -352571,8 +352571,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -352795,8 +352795,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -352840,8 +352840,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -352889,8 +352889,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -352914,8 +352914,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -353126,7 +353126,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -353166,8 +353166,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -353992,8 +353992,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -354014,8 +354014,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -354118,8 +354118,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -354342,8 +354342,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -354387,8 +354387,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -354436,8 +354436,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -354461,8 +354461,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -354673,7 +354673,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -354713,8 +354713,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -355539,8 +355539,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -355561,8 +355561,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -355665,8 +355665,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -355889,8 +355889,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -355934,8 +355934,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -355983,8 +355983,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -356008,8 +356008,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -356220,7 +356220,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -356260,8 +356260,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -357086,8 +357086,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -357108,8 +357108,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -357212,8 +357212,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -357436,8 +357436,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -357481,8 +357481,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -357530,8 +357530,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -357555,8 +357555,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -357767,7 +357767,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -357807,8 +357807,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -358633,8 +358633,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -358655,8 +358655,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -358759,8 +358759,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -358983,8 +358983,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -359028,8 +359028,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -359077,8 +359077,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -359102,8 +359102,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -359314,7 +359314,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -359354,8 +359354,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -360180,8 +360180,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -360202,8 +360202,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -360306,8 +360306,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -360530,8 +360530,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -360575,8 +360575,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -360624,8 +360624,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -360649,8 +360649,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -360861,7 +360861,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -360901,8 +360901,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -361727,8 +361727,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -361749,8 +361749,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -361853,8 +361853,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -362077,8 +362077,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -362122,8 +362122,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -362171,8 +362171,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -362196,8 +362196,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -362408,7 +362408,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -362448,8 +362448,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -363274,8 +363274,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -363296,8 +363296,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -363400,8 +363400,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -363624,8 +363624,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -363669,8 +363669,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -363718,8 +363718,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -363743,8 +363743,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -363955,7 +363955,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -363995,8 +363995,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -364821,8 +364821,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -364843,8 +364843,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -364947,8 +364947,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -365171,8 +365171,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -365216,8 +365216,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -365265,8 +365265,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -365290,8 +365290,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -365502,7 +365502,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -365542,8 +365542,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -366368,8 +366368,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -366390,8 +366390,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -366494,8 +366494,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -366718,8 +366718,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -366763,8 +366763,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -366812,8 +366812,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -366837,8 +366837,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -367049,7 +367049,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -367089,8 +367089,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -367915,8 +367915,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -367937,8 +367937,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -368041,8 +368041,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -368265,8 +368265,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -368310,8 +368310,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -368359,8 +368359,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -368384,8 +368384,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -368596,7 +368596,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -368636,8 +368636,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -369462,8 +369462,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -369484,8 +369484,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -369588,8 +369588,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -369812,8 +369812,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -369857,8 +369857,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -369906,8 +369906,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -369931,8 +369931,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -370143,7 +370143,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -370183,8 +370183,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -371009,8 +371009,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -371031,8 +371031,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -371135,8 +371135,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -371359,8 +371359,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -371404,8 +371404,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -371453,8 +371453,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -371478,8 +371478,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -371690,7 +371690,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -371730,8 +371730,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -372556,8 +372556,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -372578,8 +372578,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -372682,8 +372682,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -372906,8 +372906,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -372951,8 +372951,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -373000,8 +373000,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -373025,8 +373025,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -373237,7 +373237,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -373277,8 +373277,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -374103,8 +374103,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -374125,8 +374125,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -374229,8 +374229,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -374453,8 +374453,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -374498,8 +374498,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -374547,8 +374547,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -374572,8 +374572,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -374784,7 +374784,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -374824,8 +374824,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -375650,8 +375650,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -375672,8 +375672,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -375776,8 +375776,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -376000,8 +376000,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -376045,8 +376045,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -376094,8 +376094,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -376119,8 +376119,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -376331,7 +376331,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -376371,8 +376371,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -377197,8 +377197,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -377219,8 +377219,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -377323,8 +377323,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -377547,8 +377547,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -377592,8 +377592,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -377641,8 +377641,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -377666,8 +377666,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -377878,7 +377878,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -377918,8 +377918,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -378744,8 +378744,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -378766,8 +378766,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -378870,8 +378870,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -379094,8 +379094,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -379139,8 +379139,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -379188,8 +379188,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -379213,8 +379213,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -379425,7 +379425,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -379465,8 +379465,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -380291,8 +380291,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -380313,8 +380313,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -380417,8 +380417,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -380641,8 +380641,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -380686,8 +380686,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -380735,8 +380735,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -380760,8 +380760,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -380972,7 +380972,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -381012,8 +381012,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -381838,8 +381838,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -381860,8 +381860,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -381964,8 +381964,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -382188,8 +382188,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -382233,8 +382233,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -382282,8 +382282,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -382307,8 +382307,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -382519,7 +382519,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -382559,8 +382559,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -383385,8 +383385,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -383407,8 +383407,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -383511,8 +383511,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -383735,8 +383735,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -383780,8 +383780,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -383829,8 +383829,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -383854,8 +383854,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -384066,7 +384066,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -384106,8 +384106,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -384932,8 +384932,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -384954,8 +384954,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -385058,8 +385058,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -385282,8 +385282,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -385327,8 +385327,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -385376,8 +385376,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -385401,8 +385401,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -385613,7 +385613,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -385653,8 +385653,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -386479,8 +386479,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -386501,8 +386501,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -386605,8 +386605,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -386829,8 +386829,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -386874,8 +386874,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -386923,8 +386923,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -386948,8 +386948,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -387160,7 +387160,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -387200,8 +387200,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -388026,8 +388026,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -388048,8 +388048,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -388152,8 +388152,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -388376,8 +388376,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -388421,8 +388421,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -388470,8 +388470,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -388495,8 +388495,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -388707,7 +388707,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -388747,8 +388747,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -389573,8 +389573,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -389595,8 +389595,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -389699,8 +389699,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -389923,8 +389923,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -389968,8 +389968,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -390017,8 +390017,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -390042,8 +390042,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -390254,7 +390254,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -390294,8 +390294,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -391120,8 +391120,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -391142,8 +391142,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -391246,8 +391246,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -391470,8 +391470,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -391515,8 +391515,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -391564,8 +391564,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -391589,8 +391589,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -391801,7 +391801,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -391841,8 +391841,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -392667,8 +392667,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -392689,8 +392689,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -392793,8 +392793,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -393017,8 +393017,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -393062,8 +393062,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -393111,8 +393111,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -393136,8 +393136,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -393348,7 +393348,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -393388,8 +393388,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -394214,8 +394214,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -394236,8 +394236,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -394340,8 +394340,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -394564,8 +394564,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -394609,8 +394609,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -394658,8 +394658,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -394683,8 +394683,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -394895,7 +394895,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -394935,8 +394935,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -395761,8 +395761,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -395783,8 +395783,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -395887,8 +395887,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -396111,8 +396111,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -396156,8 +396156,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -396205,8 +396205,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -396230,8 +396230,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -396442,7 +396442,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -396482,8 +396482,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -397308,8 +397308,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -397330,8 +397330,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -397434,8 +397434,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -397658,8 +397658,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -397703,8 +397703,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -397752,8 +397752,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -397777,8 +397777,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -397989,7 +397989,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -398029,8 +398029,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -398855,8 +398855,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -398877,8 +398877,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -398981,8 +398981,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -399205,8 +399205,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -399250,8 +399250,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -399299,8 +399299,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -399324,8 +399324,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -399536,7 +399536,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -399576,8 +399576,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -400402,8 +400402,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -400424,8 +400424,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -400528,8 +400528,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -400752,8 +400752,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -400797,8 +400797,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -400846,8 +400846,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -400871,8 +400871,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -401083,7 +401083,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -401123,8 +401123,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -401949,8 +401949,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -401971,8 +401971,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -402075,8 +402075,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -402299,8 +402299,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -402344,8 +402344,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -402393,8 +402393,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -402418,8 +402418,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -402630,7 +402630,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -402670,8 +402670,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -403496,8 +403496,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -403518,8 +403518,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -403622,8 +403622,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -403846,8 +403846,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -403891,8 +403891,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -403940,8 +403940,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -403965,8 +403965,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -404177,7 +404177,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -404217,8 +404217,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -405043,8 +405043,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -405065,8 +405065,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -405169,8 +405169,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -405393,8 +405393,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -405438,8 +405438,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -405487,8 +405487,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -405512,8 +405512,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -405724,7 +405724,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -405764,8 +405764,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -406590,8 +406590,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -406612,8 +406612,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -406716,8 +406716,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -406940,8 +406940,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -406985,8 +406985,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -407034,8 +407034,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -407059,8 +407059,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -407271,7 +407271,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -407311,8 +407311,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -408137,8 +408137,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -408159,8 +408159,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -408263,8 +408263,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -408487,8 +408487,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -408532,8 +408532,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -408581,8 +408581,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -408606,8 +408606,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -408818,7 +408818,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -408858,8 +408858,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -409684,8 +409684,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -409706,8 +409706,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -409810,8 +409810,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -410034,8 +410034,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -410079,8 +410079,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -410128,8 +410128,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -410153,8 +410153,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -410365,7 +410365,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -410405,8 +410405,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -411231,8 +411231,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -411253,8 +411253,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -411357,8 +411357,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -411581,8 +411581,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -411626,8 +411626,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -411675,8 +411675,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -411700,8 +411700,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -411912,7 +411912,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -411952,8 +411952,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -412778,8 +412778,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -412800,8 +412800,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -412904,8 +412904,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -413128,8 +413128,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -413173,8 +413173,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -413222,8 +413222,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -413247,8 +413247,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -413459,7 +413459,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -413499,8 +413499,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -414325,8 +414325,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -414347,8 +414347,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -414451,8 +414451,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -414675,8 +414675,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -414720,8 +414720,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -414769,8 +414769,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -414794,8 +414794,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -415006,7 +415006,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -415046,8 +415046,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -415872,8 +415872,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -415894,8 +415894,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -415998,8 +415998,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -416222,8 +416222,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -416267,8 +416267,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -416316,8 +416316,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -416341,8 +416341,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -416553,7 +416553,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -416593,8 +416593,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -417419,8 +417419,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -417441,8 +417441,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -417545,8 +417545,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -417769,8 +417769,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -417814,8 +417814,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -417863,8 +417863,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -417888,8 +417888,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -418100,7 +418100,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -418140,8 +418140,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -418966,8 +418966,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -418988,8 +418988,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -419092,8 +419092,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -419316,8 +419316,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -419361,8 +419361,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -419410,8 +419410,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -419435,8 +419435,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -419647,7 +419647,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -419687,8 +419687,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -420513,8 +420513,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -420535,8 +420535,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -420639,8 +420639,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -420863,8 +420863,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -420908,8 +420908,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -420957,8 +420957,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -420982,8 +420982,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -421194,7 +421194,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -421234,8 +421234,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -422060,8 +422060,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -422082,8 +422082,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -422186,8 +422186,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -422410,8 +422410,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -422455,8 +422455,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -422504,8 +422504,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -422529,8 +422529,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -422741,7 +422741,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -422781,8 +422781,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -423607,8 +423607,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -423629,8 +423629,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -423733,8 +423733,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -423957,8 +423957,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -424002,8 +424002,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -424051,8 +424051,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -424076,8 +424076,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -424288,7 +424288,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -424328,8 +424328,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -425154,8 +425154,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -425176,8 +425176,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -425280,8 +425280,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -425504,8 +425504,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -425549,8 +425549,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -425598,8 +425598,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -425623,8 +425623,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -425835,7 +425835,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -425875,8 +425875,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -426701,8 +426701,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -426723,8 +426723,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -426827,8 +426827,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -427051,8 +427051,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -427096,8 +427096,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -427145,8 +427145,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -427170,8 +427170,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -427382,7 +427382,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -427422,8 +427422,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -428248,8 +428248,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -428270,8 +428270,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -428374,8 +428374,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -428598,8 +428598,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -428643,8 +428643,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -428692,8 +428692,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -428717,8 +428717,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -428929,7 +428929,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -428969,8 +428969,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -429795,8 +429795,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -429817,8 +429817,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -429921,8 +429921,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -430145,8 +430145,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -430190,8 +430190,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -430239,8 +430239,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -430264,8 +430264,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -430476,7 +430476,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -430516,8 +430516,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -431342,8 +431342,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -431364,8 +431364,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -431468,8 +431468,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -431692,8 +431692,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -431737,8 +431737,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -431786,8 +431786,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -431811,8 +431811,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -432023,7 +432023,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -432063,8 +432063,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -432889,8 +432889,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -432911,8 +432911,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -433015,8 +433015,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -433239,8 +433239,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -433284,8 +433284,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -433333,8 +433333,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -433358,8 +433358,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -433570,7 +433570,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -433610,8 +433610,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -434436,8 +434436,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -434458,8 +434458,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -434562,8 +434562,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -434786,8 +434786,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -434831,8 +434831,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -434880,8 +434880,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -434905,8 +434905,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -435117,7 +435117,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -435157,8 +435157,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -435983,8 +435983,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -436005,8 +436005,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -436109,8 +436109,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -436333,8 +436333,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -436378,8 +436378,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -436427,8 +436427,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -436452,8 +436452,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -436664,7 +436664,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -436704,8 +436704,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -437530,8 +437530,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -437552,8 +437552,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -437656,8 +437656,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -437880,8 +437880,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -437925,8 +437925,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -437974,8 +437974,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -437999,8 +437999,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -438211,7 +438211,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -438251,8 +438251,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -439077,8 +439077,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -439099,8 +439099,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -439203,8 +439203,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -439427,8 +439427,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -439472,8 +439472,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -439521,8 +439521,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -439546,8 +439546,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -439758,7 +439758,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -439798,8 +439798,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -440624,8 +440624,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -440646,8 +440646,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -440750,8 +440750,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -440974,8 +440974,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -441019,8 +441019,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -441068,8 +441068,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -441093,8 +441093,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -441305,7 +441305,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -441345,8 +441345,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -442171,8 +442171,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -442193,8 +442193,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -442297,8 +442297,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -442521,8 +442521,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -442566,8 +442566,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -442615,8 +442615,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -442640,8 +442640,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -442852,7 +442852,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -442892,8 +442892,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -443718,8 +443718,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -443740,8 +443740,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -443844,8 +443844,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -444068,8 +444068,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -444113,8 +444113,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -444162,8 +444162,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -444187,8 +444187,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -444399,7 +444399,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -444439,8 +444439,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -445265,8 +445265,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -445287,8 +445287,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -445391,8 +445391,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -445615,8 +445615,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -445660,8 +445660,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -445709,8 +445709,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -445734,8 +445734,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -445946,7 +445946,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -445986,8 +445986,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -446812,8 +446812,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -446834,8 +446834,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -446938,8 +446938,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -447162,8 +447162,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -447207,8 +447207,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -447256,8 +447256,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -447281,8 +447281,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -447493,7 +447493,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -447533,8 +447533,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -448359,8 +448359,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -448381,8 +448381,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -448485,8 +448485,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -448709,8 +448709,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -448754,8 +448754,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -448803,8 +448803,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -448828,8 +448828,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -449040,7 +449040,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -449080,8 +449080,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -449906,8 +449906,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -449928,8 +449928,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -450032,8 +450032,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -450256,8 +450256,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -450301,8 +450301,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -450350,8 +450350,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -450375,8 +450375,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -450587,7 +450587,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -450627,8 +450627,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -451453,8 +451453,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -451475,8 +451475,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -451579,8 +451579,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -451803,8 +451803,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -451848,8 +451848,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -451897,8 +451897,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -451922,8 +451922,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -452134,7 +452134,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -452174,8 +452174,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -453000,8 +453000,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -453022,8 +453022,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -453126,8 +453126,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -453350,8 +453350,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -453395,8 +453395,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -453444,8 +453444,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -453469,8 +453469,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -453681,7 +453681,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -453721,8 +453721,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -454547,8 +454547,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -454569,8 +454569,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -454673,8 +454673,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -454897,8 +454897,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -454942,8 +454942,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -454991,8 +454991,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -455016,8 +455016,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -455228,7 +455228,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -455268,8 +455268,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -456094,8 +456094,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -456116,8 +456116,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -456220,8 +456220,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -456444,8 +456444,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -456489,8 +456489,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -456538,8 +456538,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -456563,8 +456563,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -456775,7 +456775,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -456815,8 +456815,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -457641,8 +457641,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -457663,8 +457663,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -457767,8 +457767,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -457991,8 +457991,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -458036,8 +458036,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -458085,8 +458085,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -458110,8 +458110,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -458322,7 +458322,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -458362,8 +458362,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -459188,8 +459188,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -459210,8 +459210,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -459314,8 +459314,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -459538,8 +459538,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -459583,8 +459583,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -459632,8 +459632,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -459657,8 +459657,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -459869,7 +459869,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -459909,8 +459909,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -460735,8 +460735,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -460757,8 +460757,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -460861,8 +460861,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -461085,8 +461085,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -461130,8 +461130,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -461179,8 +461179,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -461204,8 +461204,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -461416,7 +461416,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -461456,8 +461456,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -462282,8 +462282,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -462304,8 +462304,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -462408,8 +462408,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -462632,8 +462632,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -462677,8 +462677,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -462726,8 +462726,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -462751,8 +462751,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -462963,7 +462963,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -463003,8 +463003,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -463829,8 +463829,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -463851,8 +463851,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -463955,8 +463955,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -464179,8 +464179,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -464224,8 +464224,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -464273,8 +464273,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -464298,8 +464298,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -464510,7 +464510,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -464550,8 +464550,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -465376,8 +465376,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -465398,8 +465398,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -465502,8 +465502,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -465726,8 +465726,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -465771,8 +465771,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -465820,8 +465820,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -465845,8 +465845,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -466057,7 +466057,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -466097,8 +466097,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -466923,8 +466923,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -466945,8 +466945,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -467049,8 +467049,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -467273,8 +467273,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -467318,8 +467318,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -467367,8 +467367,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -467392,8 +467392,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -467604,7 +467604,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -467644,8 +467644,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -468470,8 +468470,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -468492,8 +468492,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -468596,8 +468596,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -468820,8 +468820,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -468865,8 +468865,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -468914,8 +468914,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -468939,8 +468939,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -469151,7 +469151,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -469191,8 +469191,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -470017,8 +470017,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -470039,8 +470039,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -470143,8 +470143,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -470367,8 +470367,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -470412,8 +470412,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -470461,8 +470461,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -470486,8 +470486,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -470698,7 +470698,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -470738,8 +470738,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -471564,8 +471564,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -471586,8 +471586,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -471690,8 +471690,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -471914,8 +471914,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -471959,8 +471959,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -472008,8 +472008,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -472033,8 +472033,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -472245,7 +472245,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -472285,8 +472285,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -473111,8 +473111,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -473133,8 +473133,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -473237,8 +473237,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -473461,8 +473461,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -473506,8 +473506,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -473555,8 +473555,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -473580,8 +473580,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -473792,7 +473792,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -473832,8 +473832,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -474658,8 +474658,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -474680,8 +474680,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -474784,8 +474784,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -475008,8 +475008,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -475053,8 +475053,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -475102,8 +475102,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -475127,8 +475127,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -475339,7 +475339,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -475379,8 +475379,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -476205,8 +476205,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -476227,8 +476227,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -476331,8 +476331,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -476555,8 +476555,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -476600,8 +476600,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -476649,8 +476649,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -476674,8 +476674,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -476886,7 +476886,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -476926,8 +476926,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -477752,8 +477752,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -477774,8 +477774,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -477878,8 +477878,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -478102,8 +478102,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -478147,8 +478147,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -478196,8 +478196,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -478221,8 +478221,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -478433,7 +478433,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -478473,8 +478473,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -479299,8 +479299,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -479321,8 +479321,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -479425,8 +479425,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -479649,8 +479649,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -479694,8 +479694,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -479743,8 +479743,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -479768,8 +479768,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -479980,7 +479980,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -480020,8 +480020,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -480846,8 +480846,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -480868,8 +480868,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -480972,8 +480972,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -481196,8 +481196,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -481241,8 +481241,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -481290,8 +481290,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -481315,8 +481315,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -481527,7 +481527,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -481567,8 +481567,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -482393,8 +482393,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -482415,8 +482415,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -482519,8 +482519,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -482743,8 +482743,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -482788,8 +482788,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -482837,8 +482837,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -482862,8 +482862,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -483074,7 +483074,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -483114,8 +483114,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -483940,8 +483940,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -483962,8 +483962,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -484066,8 +484066,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -484290,8 +484290,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -484335,8 +484335,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -484384,8 +484384,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -484409,8 +484409,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -484621,7 +484621,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -484661,8 +484661,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -485487,8 +485487,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -485509,8 +485509,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -485613,8 +485613,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -485837,8 +485837,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -485882,8 +485882,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -485931,8 +485931,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -485956,8 +485956,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -486168,7 +486168,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -486208,8 +486208,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -487034,8 +487034,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -487056,8 +487056,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -487160,8 +487160,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -487384,8 +487384,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -487429,8 +487429,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -487478,8 +487478,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -487503,8 +487503,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -487715,7 +487715,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -487755,8 +487755,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -488581,8 +488581,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -488603,8 +488603,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -488707,8 +488707,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -488931,8 +488931,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -488976,8 +488976,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -489025,8 +489025,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -489050,8 +489050,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -489262,7 +489262,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -489302,8 +489302,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -490128,8 +490128,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -490150,8 +490150,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -490254,8 +490254,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -490478,8 +490478,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -490523,8 +490523,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -490572,8 +490572,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -490597,8 +490597,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -490809,7 +490809,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -490849,8 +490849,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -491675,8 +491675,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -491697,8 +491697,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -491801,8 +491801,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -492025,8 +492025,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -492070,8 +492070,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -492119,8 +492119,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -492144,8 +492144,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -492356,7 +492356,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -492396,8 +492396,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -493222,8 +493222,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -493244,8 +493244,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -493348,8 +493348,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -493572,8 +493572,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -493617,8 +493617,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -493666,8 +493666,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -493691,8 +493691,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -493903,7 +493903,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -493943,8 +493943,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -494769,8 +494769,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -494791,8 +494791,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -494895,8 +494895,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -495119,8 +495119,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -495164,8 +495164,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -495213,8 +495213,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -495238,8 +495238,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -495450,7 +495450,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -495490,8 +495490,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -496316,8 +496316,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -496338,8 +496338,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -496442,8 +496442,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -496666,8 +496666,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -496711,8 +496711,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -496760,8 +496760,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -496785,8 +496785,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -496997,7 +496997,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -497037,8 +497037,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -497863,8 +497863,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -497885,8 +497885,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -497989,8 +497989,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -498213,8 +498213,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -498258,8 +498258,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -498307,8 +498307,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -498332,8 +498332,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -498544,7 +498544,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -498584,8 +498584,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -499410,8 +499410,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -499432,8 +499432,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -499536,8 +499536,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -499760,8 +499760,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -499805,8 +499805,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -499854,8 +499854,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -499879,8 +499879,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -500091,7 +500091,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -500131,8 +500131,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -500957,8 +500957,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -500979,8 +500979,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -501083,8 +501083,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -501307,8 +501307,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -501352,8 +501352,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -501401,8 +501401,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -501426,8 +501426,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -501638,7 +501638,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -501678,8 +501678,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -502504,8 +502504,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -502526,8 +502526,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -502630,8 +502630,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -502854,8 +502854,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -502899,8 +502899,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -502948,8 +502948,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -502973,8 +502973,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -503185,7 +503185,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -503225,8 +503225,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -504051,8 +504051,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -504073,8 +504073,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -504177,8 +504177,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -504401,8 +504401,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -504446,8 +504446,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -504495,8 +504495,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -504520,8 +504520,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -504732,7 +504732,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -504772,8 +504772,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -505598,8 +505598,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -505620,8 +505620,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -505724,8 +505724,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -505948,8 +505948,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -505993,8 +505993,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -506042,8 +506042,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -506067,8 +506067,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -506279,7 +506279,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -506319,8 +506319,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -507145,8 +507145,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -507167,8 +507167,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -507271,8 +507271,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -507495,8 +507495,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -507540,8 +507540,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -507589,8 +507589,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -507614,8 +507614,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -507826,7 +507826,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -507866,8 +507866,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -508692,8 +508692,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -508714,8 +508714,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -508818,8 +508818,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -509042,8 +509042,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -509087,8 +509087,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -509136,8 +509136,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -509161,8 +509161,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -509373,7 +509373,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -509413,8 +509413,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -510239,8 +510239,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -510261,8 +510261,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -510365,8 +510365,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -510589,8 +510589,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -510634,8 +510634,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -510683,8 +510683,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -510708,8 +510708,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -510920,7 +510920,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -510960,8 +510960,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -511786,8 +511786,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -511808,8 +511808,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -511912,8 +511912,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -512136,8 +512136,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -512181,8 +512181,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -512230,8 +512230,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -512255,8 +512255,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -512467,7 +512467,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -512507,8 +512507,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -513333,8 +513333,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -513355,8 +513355,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -513459,8 +513459,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -513683,8 +513683,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -513728,8 +513728,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -513777,8 +513777,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -513802,8 +513802,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -514014,7 +514014,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -514054,8 +514054,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -514880,8 +514880,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -514902,8 +514902,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -515006,8 +515006,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -515230,8 +515230,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -515275,8 +515275,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -515324,8 +515324,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -515349,8 +515349,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -515561,7 +515561,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -515601,8 +515601,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -516427,8 +516427,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -516449,8 +516449,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -516553,8 +516553,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -516777,8 +516777,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -516822,8 +516822,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -516871,8 +516871,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -516896,8 +516896,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -517108,7 +517108,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -517148,8 +517148,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -517974,8 +517974,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -517996,8 +517996,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -518100,8 +518100,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -518324,8 +518324,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -518369,8 +518369,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -518418,8 +518418,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -518443,8 +518443,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -518655,7 +518655,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -518695,8 +518695,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -519521,8 +519521,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -519543,8 +519543,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -519647,8 +519647,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -519871,8 +519871,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -519916,8 +519916,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -519965,8 +519965,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -519990,8 +519990,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -520202,7 +520202,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -520242,8 +520242,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -521068,8 +521068,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -521090,8 +521090,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -521194,8 +521194,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -521418,8 +521418,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -521463,8 +521463,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -521512,8 +521512,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -521537,8 +521537,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -521749,7 +521749,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -521789,8 +521789,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -522615,8 +522615,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -522637,8 +522637,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -522741,8 +522741,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -522965,8 +522965,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -523010,8 +523010,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -523059,8 +523059,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -523084,8 +523084,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -523296,7 +523296,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -523336,8 +523336,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -524162,8 +524162,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -524184,8 +524184,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -524288,8 +524288,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -524512,8 +524512,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -524557,8 +524557,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -524606,8 +524606,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -524631,8 +524631,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -524843,7 +524843,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -524883,8 +524883,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -525709,8 +525709,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -525731,8 +525731,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -525835,8 +525835,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -526059,8 +526059,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -526104,8 +526104,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -526153,8 +526153,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -526178,8 +526178,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -526390,7 +526390,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -526430,8 +526430,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -527256,8 +527256,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -527278,8 +527278,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -527382,8 +527382,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -527606,8 +527606,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -527651,8 +527651,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -527700,8 +527700,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -527725,8 +527725,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -527937,7 +527937,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -527977,8 +527977,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -528803,8 +528803,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -528825,8 +528825,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -528929,8 +528929,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -529153,8 +529153,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -529198,8 +529198,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -529247,8 +529247,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -529272,8 +529272,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -529484,7 +529484,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -529524,8 +529524,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -530350,8 +530350,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -530372,8 +530372,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -530476,8 +530476,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -530700,8 +530700,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -530745,8 +530745,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -530794,8 +530794,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -530819,8 +530819,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -531031,7 +531031,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -531071,8 +531071,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -531897,8 +531897,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -531919,8 +531919,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -532023,8 +532023,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -532247,8 +532247,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -532292,8 +532292,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -532341,8 +532341,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -532366,8 +532366,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -532578,7 +532578,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -532618,8 +532618,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -533444,8 +533444,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -533466,8 +533466,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -533570,8 +533570,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -533794,8 +533794,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -533839,8 +533839,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -533888,8 +533888,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -533913,8 +533913,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -534125,7 +534125,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -534165,8 +534165,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -534991,8 +534991,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -535013,8 +535013,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -535117,8 +535117,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -535341,8 +535341,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -535386,8 +535386,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -535435,8 +535435,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -535460,8 +535460,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -535672,7 +535672,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -535712,8 +535712,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -536538,8 +536538,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -536560,8 +536560,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -536664,8 +536664,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -536888,8 +536888,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -536933,8 +536933,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -536982,8 +536982,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -537007,8 +537007,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -537219,7 +537219,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -537259,8 +537259,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -538085,8 +538085,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -538107,8 +538107,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -538211,8 +538211,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -538435,8 +538435,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -538480,8 +538480,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -538529,8 +538529,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -538554,8 +538554,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -538766,7 +538766,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -538806,8 +538806,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -539632,8 +539632,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -539654,8 +539654,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -539758,8 +539758,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -539982,8 +539982,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -540027,8 +540027,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -540076,8 +540076,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -540101,8 +540101,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -540313,7 +540313,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -540353,8 +540353,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -541179,8 +541179,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -541201,8 +541201,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -541305,8 +541305,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -541529,8 +541529,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -541574,8 +541574,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -541623,8 +541623,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -541648,8 +541648,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -541860,7 +541860,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -541900,8 +541900,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -542726,8 +542726,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -542748,8 +542748,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -542852,8 +542852,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -543076,8 +543076,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -543121,8 +543121,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -543170,8 +543170,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -543195,8 +543195,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -543407,7 +543407,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -543447,8 +543447,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -544273,8 +544273,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -544295,8 +544295,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -544399,8 +544399,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -544623,8 +544623,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -544668,8 +544668,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -544717,8 +544717,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -544742,8 +544742,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -544954,7 +544954,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -544994,8 +544994,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -545820,8 +545820,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -545842,8 +545842,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -545946,8 +545946,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -546170,8 +546170,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -546215,8 +546215,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -546264,8 +546264,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -546289,8 +546289,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -546501,7 +546501,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -546541,8 +546541,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -547367,8 +547367,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -547389,8 +547389,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -547493,8 +547493,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -547717,8 +547717,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -547762,8 +547762,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -547811,8 +547811,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -547836,8 +547836,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -548048,7 +548048,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -548088,8 +548088,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -548914,8 +548914,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -548936,8 +548936,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -549040,8 +549040,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -549264,8 +549264,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -549309,8 +549309,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -549358,8 +549358,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -549383,8 +549383,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -549595,7 +549595,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -549635,8 +549635,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -550461,8 +550461,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -550483,8 +550483,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -550587,8 +550587,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -550811,8 +550811,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -550856,8 +550856,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -550905,8 +550905,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -550930,8 +550930,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -551142,7 +551142,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -551182,8 +551182,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -552008,8 +552008,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -552030,8 +552030,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -552134,8 +552134,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -552358,8 +552358,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -552403,8 +552403,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -552452,8 +552452,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -552477,8 +552477,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -552689,7 +552689,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -552729,8 +552729,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -553555,8 +553555,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -553577,8 +553577,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -553681,8 +553681,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -553905,8 +553905,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -553950,8 +553950,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -553999,8 +553999,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -554024,8 +554024,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -554236,7 +554236,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -554276,8 +554276,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -555102,8 +555102,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -555124,8 +555124,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -555228,8 +555228,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -555452,8 +555452,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -555497,8 +555497,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -555546,8 +555546,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -555571,8 +555571,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -555783,7 +555783,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -555823,8 +555823,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -556649,8 +556649,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -556671,8 +556671,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -556775,8 +556775,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -556999,8 +556999,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -557044,8 +557044,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -557093,8 +557093,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -557118,8 +557118,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -557330,7 +557330,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -557370,8 +557370,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -558196,8 +558196,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -558218,8 +558218,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -558322,8 +558322,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -558546,8 +558546,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -558591,8 +558591,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -558640,8 +558640,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -558665,8 +558665,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -558877,7 +558877,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -558917,8 +558917,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -559743,8 +559743,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -559765,8 +559765,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -559869,8 +559869,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -560093,8 +560093,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -560138,8 +560138,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -560187,8 +560187,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -560212,8 +560212,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -560424,7 +560424,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -560464,8 +560464,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -561290,8 +561290,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -561312,8 +561312,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -561416,8 +561416,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -561640,8 +561640,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -561685,8 +561685,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -561734,8 +561734,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -561759,8 +561759,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -561971,7 +561971,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -562011,8 +562011,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -562837,8 +562837,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -562859,8 +562859,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -562963,8 +562963,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -563187,8 +563187,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -563232,8 +563232,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -563281,8 +563281,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -563306,8 +563306,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -563518,7 +563518,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -563558,8 +563558,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -564384,8 +564384,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -564406,8 +564406,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -564510,8 +564510,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -564734,8 +564734,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -564779,8 +564779,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -564828,8 +564828,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -564853,8 +564853,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -565065,7 +565065,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -565105,8 +565105,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -565931,8 +565931,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -565953,8 +565953,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -566057,8 +566057,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -566281,8 +566281,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -566326,8 +566326,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -566375,8 +566375,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -566400,8 +566400,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -566612,7 +566612,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -566652,8 +566652,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -567478,8 +567478,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -567500,8 +567500,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -567604,8 +567604,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -567828,8 +567828,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -567873,8 +567873,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -567922,8 +567922,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -567947,8 +567947,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -568159,7 +568159,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -568199,8 +568199,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -569025,8 +569025,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -569047,8 +569047,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -569151,8 +569151,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -569375,8 +569375,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -569420,8 +569420,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -569469,8 +569469,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -569494,8 +569494,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -569706,7 +569706,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -569746,8 +569746,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -570572,8 +570572,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -570594,8 +570594,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -570698,8 +570698,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -570922,8 +570922,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -570967,8 +570967,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -571016,8 +571016,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -571041,8 +571041,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -571253,7 +571253,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -571293,8 +571293,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -572119,8 +572119,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -572141,8 +572141,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -572245,8 +572245,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -572469,8 +572469,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -572514,8 +572514,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -572563,8 +572563,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -572588,8 +572588,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -572800,7 +572800,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -572840,8 +572840,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -573666,8 +573666,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -573688,8 +573688,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -573792,8 +573792,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -574016,8 +574016,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -574061,8 +574061,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -574110,8 +574110,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -574135,8 +574135,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -574347,7 +574347,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -574387,8 +574387,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -575213,8 +575213,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -575235,8 +575235,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -575339,8 +575339,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -575563,8 +575563,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -575608,8 +575608,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -575657,8 +575657,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -575682,8 +575682,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -575894,7 +575894,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -575934,8 +575934,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -576760,8 +576760,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -576782,8 +576782,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -576886,8 +576886,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -577110,8 +577110,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -577155,8 +577155,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -577204,8 +577204,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -577229,8 +577229,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -577441,7 +577441,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -577481,8 +577481,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -578307,8 +578307,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -578329,8 +578329,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -578433,8 +578433,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -578657,8 +578657,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -578702,8 +578702,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -578751,8 +578751,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -578776,8 +578776,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -578988,7 +578988,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -579028,8 +579028,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -579854,8 +579854,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -579876,8 +579876,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -579980,8 +579980,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -580204,8 +580204,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -580249,8 +580249,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -580298,8 +580298,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -580323,8 +580323,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -580535,7 +580535,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -580575,8 +580575,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -581401,8 +581401,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -581423,8 +581423,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -581527,8 +581527,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -581751,8 +581751,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -581796,8 +581796,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -581845,8 +581845,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -581870,8 +581870,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -582082,7 +582082,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -582122,8 +582122,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -582948,8 +582948,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -582970,8 +582970,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -583074,8 +583074,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -583298,8 +583298,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -583343,8 +583343,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -583392,8 +583392,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -583417,8 +583417,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -583629,7 +583629,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -583669,8 +583669,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -584495,8 +584495,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -584517,8 +584517,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -584621,8 +584621,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -584845,8 +584845,8 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 37,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.004",
@@ -584890,8 +584890,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 48,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 50,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1199",
@@ -584939,8 +584939,8 @@
         {},
         {
             "techniqueID": "T1020",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_renamed_rclone.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml"
         },
         {
             "techniqueID": "T1087",
@@ -584964,8 +584964,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 22,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
+            "score": 25,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml"
         },
         {},
         {
@@ -585176,7 +585176,7 @@
         {
             "techniqueID": "T1218.011",
             "score": 16,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml"
         },
         {},
         {},
@@ -585216,8 +585216,8 @@
         {},
         {
             "techniqueID": "T1053.005",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_scheduled_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml"
         },
         {
             "techniqueID": "T1558",
@@ -586042,8 +586042,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 103,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
+            "score": 104,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml"
         },
         {},
         {},
@@ -586064,8 +586064,8 @@
         {},
         {
             "techniqueID": "T1562",
-            "score": 94,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/experimental/ssa___disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
+            "score": 92,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_reg.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -586168,8 +586168,8 @@
         {},
         {
             "techniqueID": "T1055.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {},
         {},
@@ -586325,7 +586325,7 @@
             "#096ed7"
         ],
         "minValue": 0,
-        "maxValue": 51
+        "maxValue": 52
     },
     "filters": {
         "platforms": [